CVE-2026-20744: The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.

criticalCVSS 9.8CVE-2026-20744

The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: critical — CVSS 9.8
Published: 2026-07-10
Last updated: 2026-07-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-20744

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-20744	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

criticalHydro-Québec Le Circuit Electrique charging station backendcisa

Recent advisories for charging station websocket

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-54479: The WebSocket backend uses charging station identifiers to uniquely associate sessions but all…nvd · 2026-06-25
criticalCVE-2026-40702: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate c…nvd · 2026-06-25

CVE-2026-20744: The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.

Details

Referenced CVEs

Same CVEs, other sources

Recent advisories for charging station websocket

More from NVD Recent CVEs