CVE-2026-26051 is a critical missing authentication flaw (CVSS 9.4) in Mobiliti e-mobi.hu. The OCPP WebSocket endpoint accepts a connection from anyone who knows a charging station identifier. CISA lists no vendor fix, so use its network mitigations. The record does not list it in CISA's KEV catalog, and the sources we read do not report exploitation.
What's affected
- Mobiliti e-mobi.hu, all versions per the CISA advisory
- No patched version is listed
CISA says Mobiliti did not respond to its coordination request and reports no known public exploitation. It advises contacting the vendor through its customer support page. The same advisory covers three other CVEs.
How to check if you're exposed
If your charging stations connect to e-mobi.hu, list them and confirm how each one identifies itself to the backend. Look at your own logs, if available, for unexpected sessions using a station identifier from a different source address.
There is no version to compare against, so the check is about exposure and monitoring.
What to do now
- Contact Mobiliti through its customer support page to ask about a fix.
- Keep control system devices off the internet and minimize network exposure.
- Put control networks and remote devices behind firewalls, away from business networks.
- Use a current VPN for any remote access, and keep the connected devices secure.
- Watch for duplicate or unexpected sessions per station identifier and alert on them.
- Run an impact analysis and risk assessment before making changes.
Why it matters
CWE-306 is missing authentication for a critical function. In OCPP, a charger connects over a WebSocket and then speaks the protocol. If connecting needs only the station identifier, the identifier acts as the credential, and the record says it can be known or discovered. Anyone who has it can speak as that charger, or receive commands meant for it.
That means two risks. One is control of charging infrastructure. The other is corrupted data: the backend would trust telemetry from an impostor, which feeds billing and operations.
The lasting lesson is that an identifier is not a secret. Authentication needs a credential, such as a certificate or a token, that an outsider cannot derive from public information.
Quick check
Is there a fix?
Not according to CISA. The vendor did not respond to its request for coordination.
What does the score of 9.4 reflect?
Network reach, no privileges and high confidentiality and integrity impact, with lower availability impact.
Sources
Last reviewed: 19 October 2026.
