EUVD-2026-13848Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
AnalysisAI
A session management vulnerability in CTEK ChargePortal's WebSocket backend allows attackers to hijack charging station sessions by connecting with the same predictable session identifier used by legitimate stations. This enables authentication bypass, interception of backend commands intended for legitimate charging stations, and denial-of-service through session flooding. The vulnerability affects CTEK ChargePortal with a CVSS score of 7.3 and is documented in ICS-CERT advisory ICSA-26-078-06, though no active exploitation (KEV) or public POC has been reported.
Technical ContextAI
The vulnerability affects CTEK ChargePortal (CPE: cpe:2.3:a:ctek:chargeportal:*:*:*:*:*:*:*:*), which implements a WebSocket-based backend for managing electric vehicle charging stations. The root cause is CWE-613 (Insufficient Session Expiration), where the system uses charging station identifiers as session tokens without proper uniqueness enforcement or session invalidation. The WebSocket implementation fails to prevent multiple concurrent connections using identical session identifiers, allowing the most recent connection to displace existing sessions and inherit their privileges. This represents a fundamental flaw in session management where predictable identifiers combined with lack of mutual exclusion creates an authentication bypass condition in industrial control systems managing critical infrastructure.
RemediationAI
Organizations should consult CTEK support at https://www.ctek.com/support and review the CISA ICS advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-06 for vendor patches addressing the session management vulnerability. Until patches can be applied, implement network segmentation to restrict WebSocket endpoint access to authorized IP ranges only, deploy TLS mutual authentication to verify charging station identities cryptographically rather than relying solely on session identifiers, and implement rate limiting and connection monitoring to detect and block session flooding attempts. Consider deploying a reverse proxy or API gateway with session validation logic to enforce single-session-per-identifier constraints and generate cryptographically random session tokens independent of charging station identifiers.
More in Chargeportal
View allCTEK Chargeportal's OCPP WebSocket endpoints accept unauthenticated connections, allowing remote attackers to impersonat
Missing rate limiting in CTEK Chargeportal's WebSocket API enables remote attackers to launch denial-of-service attacks
Authentication identifiers for electric vehicle charging stations are publicly exposed through web-based mapping platfor
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today