Which versions of Epower Ie are affected by CVE-2026-24912?

CVE-2026-24912 allows attackers to hijack WebSocket sessions in charging station management systems by connecting multiple endpoints with identical session identifiers, potentially enabling…

How to fix or mitigate CVE-2026-24912?

Within 24 hours: Identify and inventory all systems using the affected WebSocket backend and assess which charging stations are exposed; notify relevant operations teams of the risk. Within 7 days: Implement network segmentation to restrict WebSocket endpoint access and deploy WAF rules to detect anomalous multi-endpoint connections using duplicate session IDs. Within 30 days: Develop and test session validation logic that enforces one-to-one session-to-endpoint binding; monitor vendor communications for patch availability and prepare deployment procedures.

Epower Ie CVE-2026-24912

Q: What is the CVSS score of CVE-2026-24912?

CVE-2026-24912 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Insufficient Session Expiration (CWE-613)

2026-03-06 ics-cert@hq.dhs.gov

Authentication Bypass Epower Ie

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 06, 2026 - 14:52 NVD

HIGH MEDIUM

CVSS changed

May 06, 2026 - 14:52 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 00:16 nvd

HIGH 7.3

DescriptionCVE.org

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

AnalysisAI

WebSocket session handling in charging station backends accepts duplicate session identifiers, allowing attackers to hijack active sessions and intercept commands intended for legitimate stations or impersonate authenticated users. An unauthenticated remote attacker can exploit this predictable session management to displace legitimate connections, redirect backend communications, or launch denial-of-service attacks by flooding the system with valid session requests. No patch is currently available.

Technical ContextAI

Classified as CWE-613 (Insufficient Session Expiration). The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicio