CVE-2026-27028 is a critical (CVSS 9.4) missing authentication flaw in the OCPP WebSocket endpoints of mobility46.se. An unauthenticated attacker with a known charging station identifier can act as a legitimate charger. The record lists no fixed version, so follow the CISA advisory and the vendor.
What's affected
The record names the mobility46.se charging platform. It gives no version range and no fixed version, and the advisory is CISA ICS advisory ICSA-26-057-08.
Check that advisory and contact the vendor for the status of a fix. Do not assume a patch exists without confirmation.
How to check if you're exposed
This is a hosted backend service, so exposure depends on whether your chargers connect to it. Ask the vendor how station identifiers are issued and whether the endpoint now requires credentials. Review backend logs for sessions from unexpected addresses using a known station identifier.
If you operate charging stations on any OCPP backend, check whether it demands a credential or a client certificate on connect.
What to do now
- Read CISA advisory ICSA-26-057-08 in full.
- Ask the vendor whether authentication on the WebSocket endpoint is now enforced.
- Limit network access to the backend to known charger addresses where you can.
- Review backend data for impossible readings or unknown sessions, and treat reported data from the period of exposure as unverified.
- Keep station identifiers out of public places such as labels, QR codes and public listings.
Why it matters
The weakness is CWE-306, missing authentication for a critical function. OCPP is the protocol chargers use to talk to a backend. If the backend accepts a connection that only names a station, anyone who learns the name can send and receive commands as that station.
The record says this can lead to unauthorized control of charging infrastructure and corrupted network data. Charging stations sit at the edge of the power grid, so identity checks on the backend connection matter. The record does not mark this CVE as known exploited.
Quick check
What is the key control for OCPP backends?
Require a credential or client certificate at connect time, so a station identifier alone is not enough.
Sources
- CVE-2026-27028 on Gold
- CISA advisory listed in the record: https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-08
Last reviewed: 19 October 2026.
