EUVD-2026-13859
GHSA-365r-wjfh-hwpv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
AnalysisAI
A session management vulnerability exists in the WebSocket backend of IGL Technologies' eparking.fi platform that allows multiple endpoints to connect using the same charging station identifier. An unauthenticated remote attacker can hijack legitimate charging station sessions by connecting with predictable session identifiers, enabling them to intercept backend commands, authenticate as other users, or cause denial-of-service by overwhelming the backend with concurrent session requests. This vulnerability affects operational technology (OT) infrastructure and has been disclosed by CISA ICS-CERT.
Technical ContextAI
The affected product is IGL Technologies' eparking.fi charging station management platform (CPE: cpe:2.3:a:igl-technologies:eparking.fi). The vulnerability stems from CWE-613 (Insufficient Session Expiration), where the WebSocket backend implementation fails to enforce unique session constraints per charging station identifier. The architecture allows multiple WebSocket connections to authenticate using identical session tokens, with the most recent connection displacing previous ones. This design flaw creates a race condition where sessions are not properly isolated or validated, violating the principle that each physical charging station should maintain exactly one authenticated session. The predictability of session identifiers compounds the issue by making it trivial for attackers to guess valid station identifiers without requiring cryptographic attacks.
RemediationAI
Consult the CISA ICS-CERT advisory ICSA-26-078-08 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08 for official remediation guidance from IGL Technologies regarding patches or configuration changes to enforce unique session binding per charging station. Until vendor patches are available and deployed, implement compensating controls including network segmentation to restrict WebSocket backend access to known charging station IP addresses, deploy intrusion detection systems to monitor for multiple concurrent connections from the same station identifier, and implement rate limiting to mitigate denial-of-service attempts. Consider deploying mutual TLS authentication for WebSocket connections to add cryptographic binding between stations and sessions. Review the CSAF document at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json for machine-readable remediation details and affected product versions.
More in Eparking Fi
View allUnauthenticated access to OCPP WebSocket endpoints allows remote attackers to impersonate legitimate charging stations a
Unlimited authentication attempts against the eParking.fi WebSocket API enable network-based denial-of-service attacks t
A web-based mapping platform exposes charging station authentication identifiers publicly, allowing unauthenticated netw
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today