EVs@Scale - Addressing Cybersecurity Risks Between EVSE and Charge Point Management Systems

The EVs@Scale consortium, funded by the VTO, aims to find cybersecurity gaps within EV charging industry.This report provides data, analyzes common risks, and highlights the need to secure publicly available information at all stages within charging operations.Argonne's researchers concentrated on Electric Vehicle Charging Infrastructure (EVCI), networks connecting chargers to Central Management Systems.i This work identifies risks and vulnerabilities, demonstrates open-source tool usage and results, and highlights best practices.Findings included unprotected administrative panels, web-facing Electric Vehicle Supply Equipment (EVSE) chargers running unencrypted protocols, and extensive data enumeration.The testing methodology followed four steps.First, Passive OSINT (Open-Source INTelligence) identified entities for further investigation.Next, Automated Information Gathering collected detailed data on identified organizations.Then, Correlation of Findings associated IPs, scans, and public endpoints with specific charge network operators.Finally, Analysis of the findings provided a detailed account of vulnerabilities and risks discovered, along with best practices.This methodology enabled Argonne researchers to correlate findings and risks to major Charging Network Operators (CNOs), noting a trend towards increased security.Open-source tools were used to identify web-facing servers, IoT, industrial, and networked devices which allow researchers to find insecure protocols, keywords, or business assets.All tools used during this evaluation are available to the public and free to use.To address these issues, EV charge network operators are encouraged to use cybersecurity principles and best practices when deploying networked EVCI.Recommendations include implementing least-privilege access for management consoles, secure-by-design networks using Open Charge Point Protocol (OCPP) 2.0.1, and hardening Charge Point Management Systems (CPMS) and Application Programming Interface (API) backends.To address cyber hygiene risks, operators should employ qualified managed security service providers or hire internal cybersecurity staff.Emerging protocols and standards should be independently assessed based on business needs and data handling, emphasizing future-proofing physical infrastructure, as deployments may go years without updates.This research aims to improve the management and ongoing maintenance of EVCI and ensure compliance with existing IT and OT industry security standards.i Central management systems (CMS) were examined for OCPP version 1.6/1.6jand Charging Stations Management Systems (CSMS) were examined for OCPP 2.0.1 and above.