CVE-2026-27767

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27767", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-02-23T23:48:14.385Z", "datePublished": "2026-02-26T23:57:51.070Z", "dateUpdated": "2026-03-05T20:43:40.109Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "swtchenergy.com", "vendor": "SWITCH EV", "versions": [{"status": "affected", "version": "All versions"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "WebSocket endpoints lack proper authentication mechanisms, enabling \nattackers to perform unauthorized station impersonation and manipulate \ndata sent to the backend. An unauthenticated attacker can connect to the\n OCPP WebSocket endpoint using a known or discovered charging station \nidentifier, then issue or receive OCPP commands as a legitimate charger.\n Given that no authentication is required, this can lead to privilege \nescalation, unauthorized control of charging infrastructure, and \ncorruption of charging network data reported to the backend."}], "value": "WebSocket endpoints lack proper authentication mechanisms, enabling \nattackers to perform unauthorized station impersonation and manipulate \ndata sent to the backend. An unauthenticated attacker can connect to the\n OCPP WebSocket endpoint using a known or discovered charging station \nidentifier, then issue or receive OCPP commands as a legitimate charger.\n Given that no authentication is required, this can lead to privilege \nescalation, unauthorized control of charging infrastructure, and \ncorruption of charging network data reported to the backend."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-03-05T20:43:40.109Z"}, "references": [{"url": "https://swtchenergy.com/contact/"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-06"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-06.json"}], "source": {"advisory": "ICSA-26-057-06", "discovery": "EXTERNAL"}, "title": "SWITCH EV swtchenergy.com Missing Authentication for Critical Function", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SWITCH EV did not respond to CISA's request for coordination. Contact \nSWITCH EV using their contact page here: \n<a target=\"_blank\" rel=\"nofollow\" href=\"https://swtchenergy.com/contact/\">https://swtchenergy.com/contact/</a> for more information.\n\n<br>"}], "value": "SWITCH EV did not respond to CISA's request for coordination. Contact \nSWITCH EV using their contact page here: \n https://swtchenergy.com/contact/ for more information."}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T20:36:48.316514Z", "id": "CVE-2026-27767", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T20:36:55.759Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27767", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-02T20:36:48.316514Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T20:36:51.864Z"}}], "cna": {"title": "SWITCH EV swtchenergy.com Missing Authentication for Critical Function", "source": {"advisory": "ICSA-26-057-06", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SWITCH EV", "product": "swtchenergy.com", "versions": [{"status": "affected", "version": "All versions"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://swtchenergy.com/contact/"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-06"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-06.json"}], "workarounds": [{"lang": "en", "value": "SWITCH EV did not respond to CISA's request for coordination. Contact \nSWITCH EV using their contact page here: \n https://swtchenergy.com/contact/ for more information.", "supportingMedia": [{"type": "text/html", "value": "SWITCH EV did not respond to CISA's request for coordination. Contact \nSWITCH EV using their contact page here: \n<a target=\"_blank\" rel=\"nofollow\" href=\"https://swtchenergy.com/contact/\">https://swtchenergy.com/contact/</a> for more information.\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "WebSocket endpoints lack proper authentication mechanisms, enabling \nattackers to perform unauthorized station impersonation and manipulate \ndata sent to the backend. An unauthenticated attacker can connect to the\n OCPP WebSocket endpoint using a known or discovered charging station \nidentifier, then issue or receive OCPP commands as a legitimate charger.\n Given that no authentication is required, this can lead to privilege \nescalation, unauthorized control of charging infrastructure, and \ncorruption of charging network data reported to the backend.", "supportingMedia": [{"type": "text/html", "value": "WebSocket endpoints lack proper authentication mechanisms, enabling \nattackers to perform unauthorized station impersonation and manipulate \ndata sent to the backend. An unauthenticated attacker can connect to the\n OCPP WebSocket endpoint using a known or discovered charging station \nidentifier, then issue or receive OCPP commands as a legitimate charger.\n Given that no authentication is required, this can lead to privilege \nescalation, unauthorized control of charging infrastructure, and \ncorruption of charging network data reported to the backend.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-03-05T20:43:40.109Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27767", "state": "PUBLISHED", "dateUpdated": "2026-03-05T20:43:40.109Z", "dateReserved": "2026-02-23T23:48:14.385Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-02-26T23:57:51.070Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "swtchenergy.com", "vendor": "SWITCH EV", "versions": [{"status": "affected", "version": "All versions"}]}], "source": "ics-cert@hq.dhs.gov"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:swtchenergy:swtchenergy.com:*:*:*:*:*:*:*:*", "matchCriteriaId": "5BD9A325-1924-47AF-9E3C-51FEF069A2B4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WebSocket endpoints lack proper authentication mechanisms, enabling \nattackers to perform unauthorized station impersonation and manipulate \ndata sent to the backend. An unauthenticated attacker can connect to the\n OCPP WebSocket endpoint using a known or discovered charging station \nidentifier, then issue or receive OCPP commands as a legitimate charger.\n Given that no authentication is required, this can lead to privilege \nescalation, unauthorized control of charging infrastructure, and \ncorruption of charging network data reported to the backend."}, {"lang": "es", "value": "Los puntos finales WebSocket carecen de mecanismos de autenticaci\u00f3n adecuados, lo que permite a los atacantes realizar suplantaci\u00f3n de estaci\u00f3n no autorizada y manipular datos enviados al backend. Un atacante no autenticado puede conectarse al punto final WebSocket de OCPP utilizando un identificador de estaci\u00f3n de carga conocido o descubierto, luego emitir o recibir comandos OCPP como un cargador leg\u00edtimo. Dado que no se requiere autenticaci\u00f3n, esto puede llevar a escalada de privilegios, control no autorizado de la infraestructura de carga y corrupci\u00f3n de los datos de la red de carga reportados al backend."}], "id": "CVE-2026-27767", "lastModified": "2026-06-17T10:27:39.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27767", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T20:36:48.316514Z", "version": "2.0.3"}}]}, "published": "2026-02-27T00:16:58.073", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory"], "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-06.json"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Product"], "url": "https://swtchenergy.com/contact/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-06"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "swtchenergy.com", "source": "cna", "vendor": "SWITCH EV"}, "product": "swtchenergy.com", "vendor": "switch_ev"}], "analysis": {"en": {"generated_at": "2026-04-17T14:09:48.083413+00:00", "value": {"mitigation_remediation": ["Contact SWITCH EV via their contact page at https://swtchenergy.com/contact/ to obtain a patch or to report the issue.", "Implement strong authentication for all OCPP WebSocket endpoints, ensuring that only authorized clients can initiate connections.", "Restrict network access to the WebSocket service to trusted IP ranges or use network segmentation so that only internal components and authenticated devices can reach it.", "Enable logging of all OCPP command traffic, monitor for anomalous usage, and apply rate limiting or intrusion detection to mitigate potential abuse."], "summary": {"action": "Patch ASAP", "impact": "Unauthorized Control of Charging Infrastructure"}, "threat_synthesis": {"affected_systems": "The product affected is SWITCH EV\u2019s swtchenergy.com software. All releases that expose the WebSocket OCPP interface without authentication are vulnerable; specific patch-level or version details are not publicly documented, so all current installations should be reviewed for missing authentication.", "description_and_impact": "This vulnerability stems from missing authentication on the OCPP WebSocket endpoints of the SWITCH EV software. An attacker can connect to the endpoint without credentials, impersonate charging stations, and issue or receive OCPP commands as if they were a legitimate charger. The resulting impact includes the ability to gain unauthorized control over charging infrastructure and to corrupt the data reported to the backend, potentially disrupting network integrity and availability.", "risk_and_exploitability": "The CVSS score of 9.3 signals a high\u2011severity risk, though the EPSS score of less than 1\u00a0% indicates a low exploitation probability and the vulnerability has not been listed in the CISA KEV catalog. The likely attack vector is remote, leveraging the network to reach the WebSocket endpoint. An attacker who knows a charging station identifier can establish a session, send arbitrary OCPP commands, and thereby elevate privileges to that station level."}}}}, "created": "2026-02-27T09:03:26.140297+00:00", "updated": "2026-04-17T14:15:21.812293+00:00", "vendors": ["switch_ev", "switch_ev$PRODUCT$swtchenergy.com"]}