{"id":"CVE-2026-27647","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-27647","generatedAt":"2026-10-28T04:46:25.412Z","title":"The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier.","description":"The WebSocket backend uses charging station identifiers to uniquely \nassociate sessions but allows multiple endpoints to connect using the \nsame session identifier. This implementation results in predictable \nsession identifiers and enables session hijacking or shadowing, where \nthe most recent connection displaces the legitimate charging station and\n receives backend commands intended for that station. This vulnerability\n may allow unauthorized users to authenticate as other users or enable a\n malicious actor to cause a denial-of-service condition by overwhelming \nthe backend with valid session requests.","published":"2026-02-27T01:16:21.000Z","lastModified":"2026-06-17T10:27:27.000Z","status":"Modified","sourceIdentifier":"ics-cert@hq.dhs.gov","cvss":{"version":"4.0","score":6.9,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-613"],"affected":["mobility46/mobility46.se"],"epss":{"score":0.00346,"percentile":0.27986,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-08.json","tags":["Third Party Advisory"],"source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-08","tags":["Third Party Advisory","VDB Entry"],"source":"ics-cert@hq.dhs.gov"},{"url":"https://www.mobility46.se/en/contact-us","tags":["Product"],"source":"ics-cert@hq.dhs.gov"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-27647","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}