{"id":"CVE-2026-95102","published":"2026-10-02T22:16:56.607","lastModified":"2026-10-06T15:15:48.310","description":"WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.","cvssScore":9.4,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json","tags":[]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02","tags":[]}],"exploitRefs":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows attackers to impersonate charging stations due to the lack of proper authentication mechanisms, leading to unauthorized access and potential privilege escalation.","exploitability":"Exploitation is straightforward as no authentication is required, making it easy for attackers to gain unauthorized access.","blast_radius":"If exploited, this can lead to unauthorized access to sensitive data and potentially compromise the security of the entire system.","remediation":"Enable proper authentication mechanisms for WebSocket endpoints as soon as possible.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","websocket","security"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:45:55.498Z"}}