26 February 2026
Six cloud charging back-ends
Missing authentication on charger connections (CWE-306)
CISA reported no known public exploitation on the advisories we checked
On 26 February 2026, the US Cybersecurity and Infrastructure Security Agency published six advisories on charging back-ends, from ICSA-26-057-03 to ICSA-26-057-08. We list them by ID here, and the advisories name each platform.
Separate companies built these platforms, yet the advisories describe the same type of flaw. That makes this a lesson for the whole sector, whoever your supplier is.
The weakness
A charger connects to its back-end over OCPP and identifies itself. On these platforms, the charger’s ID could be enough to be accepted as that charger. The advisories we read in detail paired that flaw with three more.
| Weakness | What it means |
|---|---|
| CWE-306 | Missing authentication on the charger connection |
| CWE-307 | No limit on authentication attempts |
| CWE-613 | Weak session handling, so one ID can hold two connections |
| CWE-522 | Charger identifiers visible on public maps |
Taken together, these flaws mean the ID works like a username with no password, and the username is public. Someone posing as a charger could be treated as the real one.
What we don’t know
- CISA reported no known public exploitation on the advisories we checked.
- We found no verified attack on an EU charge point operator using this weakness.
- An advisory describes exposure. It doesn’t say any operator was harmed.
Why it matters to operators
Most operators don’t write their back-end, so they inherit its design. In these cases, the chargers could be well maintained and the exposure would still sit in the supplier’s platform.
It also wasn’t a one-off. CISA issued at least 15 advisories on EV-charging back-ends between January and October 2026, and they’re listed in our threat record.
What to do
- Ask your supplier whether a valid charger ID with no credential is refused, and ask to see the test.
- Check whether your charger IDs appear in public maps or roaming data.
- Ask for an alert when a second connection claims the ID of an online charger.
- Move chargers to at least OCPP Security Profile 2.
- Add the question to your supplier review.
The lesson
An identifier says which charger is claimed. It doesn’t prove the claim. Authentication has to come from a credential that only the charger holds.
