CTEK Chargeportal - Critical Vulnerabilities Exposed

The Flaw

CTEK Chargeportal is facing a series of critical vulnerabilities that could be exploited by attackers. These vulnerabilities include missing authentication for critical functions and improper restrictions on excessive authentication attempts. Such flaws allow unauthorized users to gain administrative control over charging stations, leading to potential disruptions in service or even denial-of-service attacks. The affected versions are all versions of CTEK Chargeportal, making it a widespread issue.

One of the most severe vulnerabilities, identified as CVE-2026-25192, allows attackers to impersonate charging stations. This can lead to unauthorized control and manipulation of data sent to the backend system. Additionally, CVE-2026-31904 highlights the lack of rate limiting on the WebSocket API, enabling denial-of-service attacks that could suppress legitimate telemetry from chargers.

What's at Risk

The implications of these vulnerabilities are significant. With unauthorized administrative control, attackers can disrupt charging services, impacting users globally. This is especially concerning for critical infrastructure sectors like energy and transportation, where reliable charging services are crucial. The vulnerabilities also raise concerns about the integrity of data reported to backend systems, potentially leading to misinformation and operational inefficiencies.

Moreover, the presence of multiple vulnerabilities increases the attack surface. For instance, CVE-2026-27649 allows multiple endpoints to connect using the same session identifier, leading to session hijacking. This means that attackers could impersonate legitimate users, further complicating the security landscape for CTEK Chargeportal users.

Patch Status

CTEK has announced that it will be sunsetting the Chargeportal product in April 2026. This decision indicates a recognition of the vulnerabilities and a shift towards more secure solutions. However, until the product is officially retired, users must remain vigilant. The vulnerabilities have been rated with a CVSS score of 9.4, indicating a critical severity level, while others are rated 7.5 and 6.5, marking them as high and medium severity, respectively.

Organizations using CTEK Chargeportal should prioritize implementing mitigations to minimize the risk of exploitation. CISA has recommended practices for securing industrial control systems that can help organizations defend against these vulnerabilities.

Immediate Actions

For users of CTEK Chargeportal, immediate action is essential. Here are some recommended steps to enhance security:

• Minimize network exposure for all control system devices. Ensure they are not accessible from the Internet.
• Use firewalls to isolate control system networks from business networks.
• When remote access is necessary, utilize Virtual Private Networks (VPNs), but ensure they are updated to the latest versions.
• Conduct a thorough impact analysis and risk assessment before deploying any defensive measures.

By taking these proactive steps, organizations can better protect themselves against the potential exploitation of these vulnerabilities until a more secure solution is available.