Executive brief
A vulnerability in the eparking.fi charging station management platform allows unauthorized individuals to impersonate electric vehicle charging stations. By connecting to the system's communication backend without a password, an attacker could issue fake commands, stop active charging sessions, or manipulate usage data. This could lead to service disruptions, financial inaccuracies in billing, and unauthorized control over the charging infrastructure.
Technical details
The eparking.fi platform's WebSocket endpoints for the Open Charge Point Protocol (OCPP) fail to implement mandatory authentication (CWE-306). An unauthenticated remote attacker can establish a connection to the backend by supplying a valid charging station identifier. Once connected, the attacker can spoof OCPP messages to the backend or intercept commands intended for the legitimate charger. This enables unauthorized control of charging hardware, potential privilege escalation within the management system, and the injection of fraudulent charging session data. Users are advised to contact the vendor for patch information or upgrade to versions supporting authenticated communication.
Affected products
- IGL-Technologies Oy eparking.fi All versions prior to fix
Timeline
- 2026-03-19: advisory: Initial advisory released by CISA (ICSA-26-078-08)
- 2026-03-20: disclosed: CVE-2026-29796 published to NVD