Charge Portal vulnerabilities

2 known vulnerabilities in Charge Portal from CTEK. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Chargeportal: Improper Restriction of Excessive Authentication Attempts

  CVE-2026-31904Mar 20, 2026CTEK

  The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or

• 9.8 Critical severity

  Chargeportal: Missing Authentication for Critical Functionality

  CVE-2026-25192Mar 20, 2026CTEK

  WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discove