External risk intelligence

Charging Station Websocket Authentication Bypass Allows Privilege Escalation.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-20744

The vulnerability exists in a charging station websocket endpoint that lacks authentication. Charging station management interfaces and network-connected operational technology endpoints are typically designed to be reachable over the internet or public-facing networks to facilitate remote monitoring and control.

Privilege Escalation

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in charging station technology where an unauthenticated connection to a websocket endpoint could allow unauthorized access and potentially elevate user privileges.

Unauthenticated access to charging station communication.
High severity; potential for privilege escalation.
Confirm relevance and exposure to internal systems.

Attack Path

How an attacker could exploit the issue

An attacker can reach the charging station's websocket endpoint directly over the network without needing any credentials. This exposed endpoint, which should be secured, lacks proper authentication. If an attacker connects to this endpoint, they could potentially escalate their privileges within the charging station's system.

Direct network access required.
Connects to unauthenticated websocket.
Risk of privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to escalate privileges on a charging station. The charging station's websocket endpoint accepts connections without proper authentication, potentially enabling unauthorized access and control when exposed to supported networks.

Charging station privilege escalation.
Unauthenticated network access.
Unauthorized system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The charging station's unauthenticated websocket endpoint presents a critical risk, potentially allowing unauthorized access and privilege escalation. Infrastructure or platform teams managing these charging stations, in conjunction with network and security teams, should prioritize identifying all deployments. Confirming network exposure, business criticality, and accountable ownership are essential first steps before planning remediation, which may involve vendor coordination or temporary controls if immediate patching is not feasible.

Identify and confirm accountable owners.
Verify network exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the charging station software affected by CVE-2026-20744?

This software component manages the communication and operational functions of EV charging stations. These systems typically use websocket endpoints to facilitate real-time data exchange, allowing operators to monitor equipment status, manage energy loads, and control charging sessions remotely over a network.

What does this vulnerability mean for CVE-2026-20744?

The vulnerability involves an authentication failure, categorized as CWE-284 (Improper Access Control). Because the charging station's websocket endpoint does not verify who is connecting, an unauthorized user can interact with the system. This weakness effectively allows an attacker to bypass security checks and gain elevated privileges, leading to unauthorized control over the station's functions.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by directly connecting to the charging station’s websocket endpoint over a network. Because the endpoint lacks authentication, no valid credentials or prior login are required to establish the connection. The vulnerability is not triggered by legitimate, authenticated management traffic, but rather by unauthorized, raw network requests sent to that specific endpoint.

Why should I be concerned about CVE-2026-20744?

You should be concerned if your charging infrastructure is reachable over a network. According to Halo Surface Signal, these websocket endpoints are often designed for remote monitoring and control, making them likely to be exposed to public-facing networks. If your devices are internet-accessible, they are significantly more vulnerable to this type of unauthorized access than those confined to strictly isolated, internal-only networks.

What is the first step to address this CVE?

Begin by identifying all charging station units in your environment and determining their specific network connectivity. Verify which systems are exposed to public or wide-reaching networks, as these present the highest risk. Once you have an inventory and a clear understanding of your network footprint, identify the accountable teams for these assets to coordinate security controls or vendor-provided updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.