External risk intelligence

WebSocket Endpoints Allow Unauthorized Access to Charging Station Data.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-40702

The vulnerability affects WebSocket endpoints used by charging stations to communicate with central management systems. These endpoints are public-facing by design to facilitate remote connectivity and management of distributed charging infrastructure across the internet.

Missing Authentication

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts technologies that use WebSocket endpoints for communication, particularly those related to charging stations. It allows unauthorized access to sensitive data or actions due to a lack of authentication, potentially leading to system-wide security compromises.

Unauthenticated access to charging station communications.
Could allow unauthorized data access or actions.
Confirm relevance and impact to charging infrastructure.

Attack Path

How an attacker could exploit the issue

Attackers can exploit unprotected WebSocket connections to impersonate legitimate charging stations. This allows them to intercept sensitive data or execute unauthorized commands, potentially leading to system-wide compromise due to a lack of required authentication.

No authentication needed for access.
Triggers when interacting with WebSocket endpoints.
Risk of unauthorized access and actions.

Live Threat

Current exploitation, exposure, and threat context

WebSocket endpoints lacking proper authentication can allow attackers to impersonate charging stations, potentially leading to unauthorized access to sensitive data or system actions. This could result in privilege escalation and a broader compromise of system security when supported by the advisory.

Charging station system data at risk.
Impersonation via unauthenticated WebSocket.
Unauthorized data access and actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects WebSocket endpoints, likely managed by infrastructure or platform teams responsible for charging station operations. The first step is to identify all deployed charging station management systems, confirm their exposure to the internet, and determine which are business-critical. Then, accountable owners must be identified to plan remediation based on the assessed risk.

Infrastructure/Platform teams should own remediation.
Verify internet-exposed WebSocket endpoints.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2026-40702?

This CVE concerns charging station infrastructure. It specifically impacts the WebSocket endpoints used by these stations to maintain persistent communication with central management systems. These connections are the digital links that allow operators to remotely monitor, manage, and coordinate distributed EV charging hardware across a network.

What does this vulnerability mean in plain English?

This is a missing authentication weakness (CWE-306). Essentially, the software fails to verify who is connecting to the WebSocket endpoint. Because there is no 'digital ID' check, the system treats any incoming request as legitimate. An attacker can take advantage of this to act as if they are a real charging station, allowing them to read sensitive data or send unauthorized commands to the management server.

How does an attacker trigger this bug?

An attacker triggers this by initiating a connection to an unprotected WebSocket endpoint. Because the software does not require credentials, no special preconditions or elevated permissions are needed. It is important to note that simply being on the same local network is not required; this can be triggered by any entity capable of sending network traffic to the exposed endpoint.

How do I know if this is relevant to my environment?

Halo Surface Signal indicates this is highly relevant if you operate internet-facing charging station management systems. Since these WebSocket endpoints are designed to accept remote connections, they are often public-facing by default, making them reachable over the internet. You should care if your infrastructure exposes these endpoints to facilitate wide-area connectivity.

What is the first step to address CVE-2026-40702?

Start by auditing your network architecture to create an inventory of all charging station management systems. Specifically, identify which of these systems have WebSocket endpoints exposed to the public internet. Once you have a clear list of these entry points, coordinate with your infrastructure or platform teams to prioritize them for security hardening, focusing first on those that handle the most critical business functions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.