Critical Vulnerabilities Found in EV Charging Stations
Basically, hackers can control charging stations and disrupt services due to security flaws.
Critical vulnerabilities have been found in EV Energy's charging stations, risking unauthorized control and service disruptions. This affects electric vehicle users worldwide. Stay alert for updates and potential fixes from EV Energy.
What Happened
A serious security issue has been uncovered in EV Energy's charging stations, affecting users worldwide. Hackers can exploit these vulnerabilities to gain unauthorized control over charging stations or disrupt services entirely. This is not just a minor glitch; it poses a significant risk to the infrastructure that supports electric vehicle charging.
The vulnerabilities, identified as CVE-2026-27772, CVE-2026-24445, CVE-2026-26290, and CVE-2026-25774, allow attackers to manipulate data, impersonate charging stations, and even launch denial-of-service attacks?. This means that a malicious actor could potentially shut down charging services or redirect them, causing chaos for EV users who rely on them.
These issues stem from design flaws in the WebSocket? API used by EV Energy. For instance, one vulnerability allows attackers to connect to the system without proper authentication?, while another lacks restrictions on the number of authentication? requests, making it easier for attackers to flood the system with requests, leading to service disruptions.
Why Should You Care
If you own an electric vehicle or rely on charging stations, this is a big deal for you. Imagine pulling up to a charging station only to find it offline or manipulated by someone who shouldn’t have access. These vulnerabilities could disrupt your ability to charge your vehicle, affecting your daily commute or travel plans.
Moreover, as electric vehicles become more popular, the security of the infrastructure supporting them becomes increasingly critical. Just like you wouldn’t want someone tampering with the gas pumps at a station, you don’t want hackers messing with charging stations. Your safety and convenience depend on the reliability of these systems.
What's Being Done
Currently, EV Energy has not responded to requests for coordination from the Cybersecurity and Infrastructure Security Agency (CISA). However, they are aware of the vulnerabilities and are expected to issue fixes soon. Here’s what you can do right now:
- Stay informed about updates from EV Energy regarding patches.
- Avoid using charging stations until the vulnerabilities are addressed.
- Monitor your vehicle’s charging status closely.
Experts are keeping a close eye on this situation to see how quickly EV Energy can roll out fixes and whether any attacks will occur before those patches are implemented.
CISA Advisories