OTPulse

SWITCH EV swtchenergy.com

Plan PatchCVSS 9.4ICS-CERT ICSA-26-057-06Feb 26, 2026
EnergyTransportation
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Multiple critical vulnerabilities in SWITCH EV charging station management platform affect authentication, session handling, and data integrity. Attackers can impersonate charging stations to hijack sessions, suppress or misroute traffic causing denial of service, and manipulate transaction data sent to the backend. The vulnerabilities stem from insufficient security validation (CWE-306), weak session mechanisms (CWE-307), insufficient HTTPS enforcement (CWE-613), and inadequate credential protection (CWE-522). The vendor did not respond to CISA coordination requests.

What this means
What could happen
An attacker could impersonate legitimate charging stations, hijack user sessions, suppress or reroute charging traffic causing widespread service outages, and manipulate data sent to the backend system. This could disable charging infrastructure across affected networks and enable theft of transaction data.
Who's at risk
Electric utilities and fleet operators deploying SWITCH EV charging station management systems should be aware that all versions of the platform are affected. This impacts EV charging networks, fleet charging operations, and utility-operated public charging infrastructure.
How it could be exploited
An attacker with network access to the SWITCH EV platform could exploit weak authentication and session management to impersonate charging stations and intercept session tokens. Once authenticated as a station, the attacker could drop or redirect charging requests to cause denial of service, or modify transaction data before it reaches the backend system.
Prerequisites
  • Network access to the SWITCH EV platform
  • No valid credentials required for initial exploitation
  • Ability to intercept or forge network traffic
remotely exploitableno authentication requiredlow complexityno patch availableactively exploitable (vendor unresponsive)critical CVSS score (9.4)
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (1)
ProductAffected VersionsFix Status
swtchenergy.com: vers:all/*All versionsNo fix (EOL)
Remediation & Mitigation
0/4
Do now
0/1
WORKAROUNDContact SWITCH EV directly via https://swtchenergy.com/contact/ to request a security update or vendor guidance
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HARDENINGDeploy network monitoring and anomaly detection to identify forged charging station connections or unusual traffic patterns
HARDENINGImplement TLS certificate pinning on charging stations to prevent session hijacking attacks
Mitigations - no patch available
0/1
swtchenergy.com: vers:all/* has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:
HARDENINGImplement network segmentation to restrict access to the SWITCH EV charging platform from untrusted networks
View full CISA ICS-CERT advisory
API: /api/v1/advisories/968faae9-286d-4ccc-80b0-6a6023515357

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

SWITCH EV swtchenergy.com | CVSS 9.4 - OTPulse