Vulnerabilities in IGL-Technologies eParking.fi Exposed
Basically, hackers can take control of charging stations due to security flaws.
Critical vulnerabilities have been found in IGL-Technologies eParking.fi. These flaws could allow unauthorized access and disrupt charging services. Immediate updates are necessary to protect users and infrastructure.
The Flaw
Recent vulnerabilities have been discovered in IGL-Technologies' eParking.fi software, affecting all versions. These flaws allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. The vulnerabilities stem from missing authentication and improper restrictions, which can lead to significant security breaches.
The most critical vulnerability, identified as CVE-2026-29796, involves WebSocket endpoints lacking proper authentication mechanisms. Attackers can impersonate charging stations, manipulate backend data, and escalate privileges without any authentication. This could severely compromise the integrity of the charging network.
What's at Risk
The vulnerabilities primarily affect the energy and transportation sectors, as eParking.fi is widely deployed for electric vehicle charging stations globally. If exploited, these vulnerabilities could lead to unauthorized access to charging infrastructure, potentially disrupting services for users and affecting the reliability of electric vehicle networks.
Moreover, the risk of denial-of-service attacks is significant. Attackers could suppress legitimate charger telemetry or conduct brute-force attacks to gain unauthorized access, which could paralyze charging services and inconvenience users.
Patch Status
IGL-Technologies has acknowledged these vulnerabilities and has taken steps to mitigate the risks. They have updated the eParking's OCPP servers to enforce stronger authentication and implemented device-level whitelisting. Additionally, they have introduced rate-limiting controls to prevent excessive requests that could lead to denial-of-service conditions.
Despite these updates, devices using the encrypted deployment of eParking's OCPP servers or IGL-Technologies' proprietary eTolppa protocol remain unaffected. The company is committed to ongoing vulnerability monitoring under their ISO 27001:2022 security program to enhance future security measures.
Immediate Actions
Organizations using IGL-Technologies eParking.fi should take immediate action to protect their systems. It is crucial to ensure that all devices are updated with the latest security patches and that strong authentication measures are in place.
Furthermore, users should minimize network exposure for all control system devices and ensure they are not directly accessible from the Internet. Implementing firewalls and isolating control system networks from business networks can significantly reduce the risk of exploitation. Regular monitoring and adherence to cybersecurity best practices are essential to safeguard against potential attacks.