EUVD-2026-13859
GHSA-365r-wjfh-hwpv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPredict charging station session identifier
-
DeliveryConnect WebSocket with known identifier
-
ExploitDisplace legitimate station connection
-
ExecutionReceive backend commands intended for victim
-
ImpactExecute unauthorized actions or cause denial-of-service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V7 - Session Management Session expiration enforcement
|
| Exploitation Conditions | Remote unauthenticated attacker can exploit the WebSocket backend by connecting with predictable or known charging station identifiers. No victim interaction required. Affects default WebSocket configurations allowing multiple concurrent connections per session identifier without proper validation. |
| Impact | The CVSS score of 7.3 (High severity) reflects the network-based attack vector (AV:N), low attack complexity (AC:L), and no required privileges (PR:N) or user interaction (UI:N), making this vulnerability highly accessible to remote attackers. The impact spans confidentiality, integrity, and availability (C:L/I:L/A:L), indicating potential for multi-dimensional attacks on critical infrastructure. As an ICS-CERT advisory targeting operational technology in electric vehicle charging infrastructure, this represents a real-world risk to physical systems beyond typical IT vulnerabilities. The authentication bypass tag and charging station context suggest attackers could manipulate charging operations, intercept payment data, or disrupt service availability. While no EPSS score or KEV listing is provided, the OT/ICS context, public disclosure via CISA, and low attack complexity elevate this beyond typical high-CVSS-but-low-risk vulnerabilities. Organizations operating affected charging infrastructure should prioritize remediation due to potential safety and operational impact. |
| Exploit ScenarioDerived | An attacker identifies exposed WebSocket endpoints for an eparking.fi charging infrastructure deployment through internet scanning. By analyzing network traffic or testing sequential station identifiers, the attacker determines the predictable format used for charging station session identifiers. The attacker then establishes WebSocket connections using legitimate station identifiers, automatically displacing the authentic charging stations and intercepting all backend commands including payment processing instructions, charging authorization requests, and operational control messages. This enables the attacker to manipulate charging sessions, harvest payment data, or flood the backend with thousands of concurrent fake sessions from different station IDs to render the entire charging network inoperable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
A session management vulnerability exists in the WebSocket backend of IGL Technologies' eparking.fi platform that allows multiple endpoints to connect using the same charging station identifier. An unauthenticated remote attacker can hijack legitimate charging station sessions by connecting with predictable session identifiers, enabling them to intercept backend commands, authenticate as other users, or cause denial-of-service by overwhelming the backend with concurrent session requests. This vulnerability affects operational technology (OT) infrastructure and has been disclosed by CISA ICS-CERT.
RemediationAI
Consult the CISA ICS-CERT advisory ICSA-26-078-08 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08 for official remediation guidance from IGL Technologies regarding patches or configuration changes to enforce unique session binding per charging station. Until vendor patches are available and deployed, implement compensating controls including network segmentation to restrict WebSocket backend access to known charging station IP addresses, deploy intrusion detection systems to monitor for multiple concurrent connections from the same station identifier, and implement rate limiting to mitigate denial-of-service attempts. Consider deploying mutual TLS authentication for WebSocket connections to add cryptographic binding between stations and sessions. Review the CSAF document at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json for machine-readable remediation details and affected product versions.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is IGL Technologies' eparking.fi charging station management platform (CPE: cpe:2.3:a:igl-technologies:eparking.fi). The vulnerability stems from CWE-613 (Insufficient Session Expiration), where the WebSocket backend implementation fails to enforce unique session constraints per charging station identifier. The architecture allows multiple WebSocket connections to authenticate using identical session tokens, with the most recent connection displacing previous ones. This design flaw creates a race condition where sessions are not properly isolated or validated, violating the principle that each physical charging station should maintain exactly one authenticated session. The predictability of session identifiers compounds the issue by making it trivial for attackers to guess valid station identifiers without requiring cryptographic attacks.
Know when Eparking Fi gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
Executive ViewAI
CVE-2026-32663 exposes the eparking.fi charging infrastructure to session hijacking attacks, allowing unauthorized individuals to intercept commands, impersonate legitimate users, and disrupt service availability. This vulnerability directly threatens operational continuity of electric vehicle charging networks and customer trust, with no vendor patch currently available.
Implement network-based rate limiting on WebSocket connections to prevent session enumeration; segment charging infrastructure behind VPN/firewall requiring station authentication credentials before backend access; enable detailed audit logging of all WebSocket session establishments and command execution; deploy intrusion detection on backend networks to identify anomalous session patterns; consider disabling remote WebSocket management features until patch availability; enforce IP whitelisting for authorized charging station locations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Eparking Fi
View allUnauthenticated access to OCPP WebSocket endpoints allows remote attackers to impersonate legitimate charging stations a
Unlimited authentication attempts against the eParking.fi WebSocket API enable network-based denial-of-service attacks t
A web-based mapping platform exposes charging station authentication identifiers publicly, allowing unauthenticated netw
Exploit-DB