Plugged In and Exposed: The Growing Cybersecurity Threat to EV Charging Infrastructure

By Adrian Cheek, Senior Cybercrime Researcher

Publicly exposed EV charging infrastructure remains an unresolved cybersecurity problem. Security practitioner Ken Munro has spent years taking apart the machines that charge electric cars. When asked what actually kept him up at night, he did not point to any one broken device. He pointed at all of them at once. A single compromised charger is a nuisance. Thousands of them switching on and off in unison, on the same scheduled overnight cycle, is a lever against the power grid itself.

That scenario has lived in security researchers’ warnings for the better part of a decade, but it depends on a precondition that is easy to state and rarely measured: that the chargers are reachable, and that reaching them is not hard. We set out to measure the second half of that precondition through passive collection, and we identified 1,000 internet-facing EV charging endpoints across 56 countries, fingerprinted internet-facing charging endpoints and then followed the identifiers those endpoints revealed to find more. The results were consistent across the collected population: of the 1,000 internet-facing EV charging endpoints, 720 (72%) accept connections with no transport-layer encryption. The protocol that carries authentication tokens, session commands, and the path to payment and backend systems runs in the clear on most of the endpoints we observed. 

Caveat: Our findings do not demonstrate the ability to coordinate charging loads or to move against the grid. They demonstrate that one prerequisite for such an attack is still widely present: reachable, poorly protected communications. Everything that follows should be read in that frame: this is a measurement of exposure, not a demonstration of impact.

Key Takeaways of EV Charging Endpoint Security

• 72% of observed charging endpoints lack transport encryption. Of 1,000 Open Charge Point Protocol (OCPP) endpoints identified through passive collection, 720 accepted unencrypted connections, meaning traffic carrying authentication tokens, session commands, and payment data travels without TLS protection.
• Three software platforms account for a third of the exposure. A single open-source management system (SteVe) made up 216 endpoints (167 unencrypted). Two other platforms contributed another 124, almost none using TLS. Platform concentration means a weakness in one software stack propagates across hundreds of deployments.
• Real-world incidents demonstrate impact at every tier: from nuisance defacements (Isle of Wight, 2022) to data exposure (Shell Recharge, 116,000 records from an Indian provider) to hardware takeover (Pwn2Own 2024, CISA advisory ICSA-26-062-08) to grid-level supply-chain compromise (Russian M11 motorway).
• OCPP 1.6, the dominant deployed version, has no built-in encryption. Released in 2015, it remains the most widely deployed version in the field. Newer versions (2.0.1 and 2.1) added certificate-based security, but sightings of these versions were rare in Flare’s collection.
• No single party owns the cost of fixing the problem. Responsibility is split across charger manufacturers, charging point operators, software vendors, and multiple government agencies, creating an incentive structure where the exposure persists because no one bears the full cost of remediation.

1,000 Endpoints, Most of Them in the Clear 

Between June 14-July 14, 2026, we ran an iterative passive discovery process against internet-facing OCPP endpoints. Rather than rely on a single fingerprint, the collection seeded on known charging management platforms, extracted the distinctive identifiers each one exposed, and queried those identifiers across multiple device search engines to surface more. The process was repeated until additional rounds yielded diminishing returns, indicating that the collection had stabilized for this methodology rather than simply being cut short. It converged at 1,000 distinct OCPP charging endpoints across 56 countries.

Of those 1,000 endpoints, 720 (72%), answered with no transport-layer encryption: no encrypted network connection (TLS) protecting traffic in transit. These are charge points and charge point management systems accepting unencrypted OCPP connections from anyone who reaches them, on the protocol that carries authentication tokens, session commands, and in many deployments the path to payment and backend systems. 

This is a measurement of transport security specifically, not of authentication or application security, and the two should not be conflated. The proportion held steady as the dataset grew, which is what gives it weight: it is not an artifact of a narrow sample but a stable property of the observed population.

Platform Concentration

The exposure also concentrates in a small number of platforms, and that concentration increases systemic risk because a weakness in one software stack propagates across hundreds of deployments:

• SteVe (open-source management system): 216 of the 1,000 endpoints, 167 of them without encrypted transport
• Embedded firmware stack (common charger hardware stack): 66 endpoints, none of them using TLS
• Commercial platform (identifiable by a consistent server banner): 58 endpoints, none with encrypted connections

Between them, three platforms make up a third of the observed population, and almost none of that third encrypts its traffic. When one software image is deployed across hundreds of endpoints, its default posture becomes the posture of the whole fleet. Here, that default is encrypted transport.

Geographic Distribution

Geographically, the exposure skewed toward Europe. Germany led with 234 endpoints, followed by the United States with 148, France with 63, and China with 46, with the remainder spread across another 52 countries. No single region owns the problem.

Country refers to the network location of the endpoint as reported by the search platforms used in collection, meaning the geolocation of the IP address answering on the OCPP port. It does not indicate where the operator or the manufacturer is based. The counts are of distinct endpoints. A single management system can front many physical chargers, so the figures measure exposed management surface and carry no implication about fleet size.

The collection seeded on known platforms and pivoted through the identifiers of those platforms exposed, so the country distribution follows the reach of that seed set. It is not a census of national charging estates.

Methodological Notes

Every number above reflects what a device advertised in a network banner, not a confirmed vulnerability and not a successful intrusion. An endpoint being reachable or unencrypted is not the same as an endpoint being exploited. We made no attempt to authenticate to, interact with, or disrupt any live system. Encryption status is determined by the presence or absence of an observed encrypted handshake for each endpoint. 

The population was cleaned of false positives (including unrelated software that shares a web-server signature with certain charging platforms and cellular routers that are not chargers, and test and simulator instances). The figure of 1,000 is a converged result for this collection method, not a claim about the total number of charging endpoints on the internet, which is larger.

Prior research puts the full population well beyond what any single collection surfaces. A group of researchers building the ChargePrint framework, presented at the NDSS Symposium in 2023, fingerprinted 27,439 internet-connected charging stations worldwide and found roughly 92 percent of them carrying at least one vulnerability. These 1,000 endpoints represent a current, conservative, and independently cleaned slice of that larger reality. 

EV Charging Cyber Incidents Have Already Happened at Every Level

The exposure matters because attackers have already demonstrated what each level of access is worth. The history of EV charging incidents is not a list of hypotheticals. It is a staircase, and every step has been walked in the wild.

Nuisance

In April 2022, council-operated chargers on the Isle of Wight in England were redirected to display pornographic websites in place of the local authority’s homepage. Staff resorted to covering the screens with tape. 

In January 2023, a driver found an Electrify America station in California displaying a political meme instead of its welcome interface. 

The same month, a researcher walked up to a new 350-kilowatt Electrify America unit in Kettleman City and found an open TeamViewer remote-access session sitting on the touchscreen. Using only the charger’s own display, he moved a cursor, opened a browser, and navigated the station’s Windows operating system freely. The operator’s response was to note that unauthorized access is a crime. It did not explain why the session was open.

Data

The screens were the visible failures. The quieter ones cost more. 

In June 2023, security researcher Anurag Sen located an unprotected cloud database belonging to Shell Recharge, hosted on Amazon’s cloud with no password, holding close to a terabyte of logging data from Shell’s charging network (built in part on its 2019 acquisition of Greenlots). The exposed records carried names, email addresses, and phone numbers of fleet customers, the locations of charging stations including private residential points, and, in one record, the home address of the Greenlots chief executive. Sen contacted Shell and heard nothing; the database went offline only after a reporter made contact. 

In November 2024, roughly 116,000 records surfaced on a deep web forum, traced by Upstream’s threat intelligence team to a common charging application from an Indian energy management provider whose software served charging point operators across eight countries and territories. That set included names, addresses, VINs, raw authentication keys and tokens, and precise station geolocation.

Takeover

Then came control of the hardware itself. At Pwn2Own Automotive in Tokyo in 2024, the Synacktiv team compromised three chargers and a Tesla modem, defeating a MaxiCharger through a Bluetooth authentication bypass built on a hardcoded six-digit token and chaining stack overflows into arbitrary code execution. Firmware analysts at ONEKEY disclosed unauthenticated remote command execution in eCharge Hardy Barth controllers, tracked as CVE-2024-11665 and CVE-2024-11666, alongside embedded SSH keys and plaintext credentials that exposed deployed devices to remote access. 

In March 2026, CISA advisory ICSA-26-062-08 documented critical flaws in the Everon OCPP backend, scored 9.4 on the CVSS scale: WebSocket endpoints that accepted a known or discovered station identifier with no authentication check, letting a remote attacker issue OCPP commands as a legitimate charger, hijack sessions, and escalate to administrative control. Everon was not alone. The same disclosure wave carried near-identical WebSocket authentication-bypass advisories for a cluster of other OCPP backends, evidence that the weakness sits in how the protocol is commonly implemented rather than in one vendor’s code.

Grid

The top of the staircase is the one Munro warned about. His firm, Pen Test Partners, spent eighteen months analyzing seven popular home charger models and found critical flaws in five of them, which is the basis for his concern about coordinated load rather than any single device. And that top rung has a precedent too. 

Chargers along Russia’s M11 motorway between Moscow and Saint Petersburg were disabled outright when a Ukrainian supplier that had built the units’ internal controllers used a backdoor in its own hardware to shut the stations down and replace their displays with anti-government slogans. The operator confirmed the attack and pulled the network for maintenance. Supply-chain compromise reaching through the manufacturer into the field is not a scenario to be modeled. It has already been executed against a national charging network.

The Protocol at the Center of it All

Most networked chargers talk to their cloud management systems over OCPP, an open standard now mandatory for federally funded United States charging infrastructure. OCPP 1.6, released in 2015, has no public-key encryption, and it remains the version most widely deployed in the field. Charger-to-backend traffic runs in the clear unless an operator independently stands up a VPN or an isolated cellular link. Many do not, which is consistent with what Flare observed: most exposed endpoints do not encrypt at the transport layer.

Version 2.0.1 added certificate-based security in 2020 and version 2.1 followed in January 2025, but replacing deployed hardware takes years and backward compatibility is not guaranteed. Among the 1,000 endpoints Flare collected, sightings of the newer versions were rare.

A Structural Weakness

The protocol also carries a documented structural weakness. It does not define how a charge point management system should handle two simultaneous connections claiming to be the same charger. Security firm SaiFlow demonstrated that an attacker can open a fresh WebSocket on behalf of a charger already in session and force the legitimate connection to drop, then intercept payment data, run denial-of-service across a network, or extract backend credentials. The management-system URL for a given charger, SaiFlow noted, can often be found through Shodan. That last detail is the whole problem in one sentence: the front door is indexed.

Why the Fix Never Arrives

The technical recommendations have barely changed in years: migrate to OCPP 2.0.1 or later, keep administrative interfaces off the public internet, segment chargers from backend systems, test recurrently. None of it is exotic, and none of it is happening at scale. The reason is not ignorance. It is that no single party owns the cost of fixing it while everyone shares the cost of leaving it broken.

Misaligned Incentives

OCPP 1.6 works commercially. A charger running it takes payment and delivers electrons whether or not the link is encrypted, so an operator gains nothing visible from the upgrade and absorbs real expense and downtime to perform it. 

Manufacturers have repeatedly treated disclosure as an inconvenience: Shell did not act on the researcher who found its exposed database until a journalist made contact, and ONEKEY got no substantive response from eCharge over its remote-command-execution findings until Germany’s federal cybersecurity agency, the BSI, notified the vendor on ONEKEY’s behalf.

Oversight in the United States is split across the Departments of Transportation, Energy, and Homeland Security, with NIST, CISA, and the Department of Energy each publishing guidance that no one is obligated to follow. When responsibility is distributed that widely, it effectively belongs to no one.

Independent Confirmation

Independent measurement keeps confirming the result, and our own collection is only the latest entry. Work from Argonne National Laboratory located chargers sitting directly on the public internet running outdated services behind weak credentials, some reachable simply by searching for the OCPP WebSocket header. Previous research found stations online with no access controls and default passwords still in place. The ChargePrint work put a number on the vulnerability rate: 92% of tens of thousands of discovered hosts. The 1,000 endpoints we found, three-quarters of them unencrypted, add a current data point to a pattern that is not in dispute. It is documented, repeatedly, by everyone who looks.

Not Just Another IoT Problem

EV chargers carry the familiar weaknesses of any internet-connected device: default credentials, infrequent firmware updates, and poor segmentation. What sets them apart is the blast radius. A single compromised charger touches transportation infrastructure, the electrical grid, and payment processing at the same time. It holds personally identifiable information, runs credit-card transactions, and switches significant electrical load. 

Vehicle-to-grid technology, which lets a parked car feed power back into the network, deepens the coupling between a consumer device and critical infrastructure. The reason the grid scenario is worth taking seriously is that the connection is now bidirectional, and the endpoints, as our collection shows, are reachable. Reachable is not the same as attackable at scale, but it is a necessary condition, and that condition exists.

The Question the Industry has not Answered

At Pwn2Own Automotive 2026, Level Three superchargers were added as a target category for the first time. Over three days, researchers disclosed 76 unique vulnerabilities. One team earned $60,000 for the first public exploit of a supercharger, reaching an Alpitronic HYC50 through the charging gun itself. Another took over an Autel MaxiCharger by swiping an NFC card. The organizers noted that cross-device communication passing through the charging connector had caught much of the industry by surprise.

Those are the flaws white-hat researchers found when they were invited to look. The open question is how many of the same weaknesses are sitting in the chargers drivers are plugging into at this moment, at highway rest stops and in parking garages, with no one looking. 

Our collection does not answer that in full, and does not pretend to. What it shows is narrower and, in its way, more telling. 1,000 charging endpoints, surfaced by passive collection and cleaned of everything that was not a charger, and 720 of them accept unencrypted connections over the open internet. A third of them run just three software platforms, and almost none of that third encrypts transport traffic. This is not a story about one broken charger. It is the shape of the fleet.

What Security Teams Should Do Now

The findings point to a small number of controls that address most of the exposure directly. They apply on both sides of the connection: to the charging operators who run the endpoints, and to the enterprise and fleet teams who increasingly own chargers on their own networks. The two audiences share the same protocol and, largely, the same failure modes.

• Require transport encryption on every charger connection. The single most common failure in the collected data was the absence of transport encryption. Operators should require TLS on every charger-to-backend connection, which in practice means moving to OCPP 2.0.1 or later and provisioning certificates. Where hardware cannot yet be upgraded, OCPP 1.6 should be tunneled over a VPN or a private cellular APN so it is never exposed in the clear. Enterprise teams should verify with their vendor, in writing, that management traffic from any charger on their premises is encrypted end to end, and should treat an unencrypted OCPP session on their network as they would any other cleartext credential channel.
• Get management interfaces off the public internet. A charge point management endpoint should not answer an unsolicited connection from an arbitrary address. Operators should place CSMS and administrative interfaces behind a VPN, an allowlist, or a private network path, and expose only what genuinely must be reachable. Enterprise teams can establish their own exposure passively, without touching any device: commercial internet scan indexes already publish what is visible on an organization’s own address ranges, including OCPP and charger-management signatures and the platform banners named in this research. Because those indexes are built from data already collected, consulting them reveals what any outside party can also see, with no active scanning of the organization’s own or anyone else’s infrastructure. A management interface that appears in those indexes is reachable by everyone else too.
• Inventory the platform you run, because concentration cuts both ways. A third of the exposed population ran just three software platforms. Concentration raises the stakes, since one weak default propagates across an entire fleet, and it also gives defenders leverage, since fixing the default once fixes it everywhere. Both operators and enterprise owners should maintain an inventory of the exact CSMS or charger firmware they run, including self-hosted open-source platforms, subscribe to the relevant advisories, and track the disclosure history of that specific stack instead of assuming a vendor is handling it.
• Change default credentials and identifiers, and assume station IDs are public. Possession of a station identifier should never be sufficient to issue commands. Several of the 2026 advisories hinged on management endpoints that accepted a known or discoverable identifier with nothing further behind it, no shared secret, no certificate. Because that identifier travels in the connection URL under OCPP 1.6-J, and 72% of the endpoints in this dataset accept connections with no transport encryption, it is not a secret in any operational sense. Rotating default or sequential identifiers is still worth doing, but on an unencrypted connection it is a speed bump, not a control; the fix is authentication that does not derive from the identity string. Basic Auth over TLS on 1.6-J, or security profile 2 or 3 on 2.0.1. Operators should confirm which profile their central system enforces and whether it will still accept a downgraded connection. Site hosts who do not run the platform have a different lever: specify the profile in the tender and test for it on acceptance, rather than inheriting the installer’s defaults. Chargers should also sit inside the same secrets-management and credential-monitoring scope as the rest of the connected estate, including automated monitoring for exposed credentials surfacing in stealer logs, underground forums, and leaked datasets.
• Segment chargers from everything that matters. Because a compromised charger can touch payment, identity, and electrical-load systems at once, it should sit on its own network segment with no lateral path to business systems, payment infrastructure, or building controls. This is the control that limits blast radius when one of the others fails, and it is squarely the enterprise team’s responsibility even when the charger itself is vendor-managed.
• Treat exposure monitoring as continuous, and scope assessment to the whole chain. A single point-in-time check misses the drift that puts an interface back on the internet after the next firmware push or network change. Both audiences should monitor their external exposure on an ongoing basis, drawing first on passive sources that require no interaction with live systems: public device-search indexes, certificate transparency logs, and passive DNS all reveal newly exposed endpoints without probing them. Where deeper, authorized security testing is warranted, it should be conducted by the asset owner or their designated tester under proper authorization, and scoped to cover the charger, the communication link, and the backend together, since the 2026 competition results showed attacks crossing between them through the charging connector itself. For operators this is a product-security obligation; for enterprise owners it is a requirement to write into the vendor contract.

Minding the Growing Gap Between Researchers’ Findings and Industry Deployments

Every independent measurement, from ChargePrint’s 27,000 hosts to Argonne’s exposed services to the 1,000 unencrypted endpoints we found, arrives at the same conclusion: the charging fleet is reachable, largely unencrypted, and concentrated on a small number of software platforms whose defaults prioritize function over security. Every level of the attack staircase, from screen defacement to data exposure to hardware takeover to supply-chain compromise of a national network, has already been demonstrated in the field. The technical remediation is well understood and has been for years. What remains missing is an incentive structure that makes the cost of fixing the problem fall on someone specific, before the cost of leaving it broken falls on everyone at once. Our findings do not predict when that moment will arrive, and we can only measure how many doors are open while the industry debates who holds the key.