CVE-2026-24912 in epower.ie
Summary
by MITRE • 03/06/2026
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/06/2026
This vulnerability resides in the WebSocket backend implementation of charging station systems where session management lacks proper security controls. The flaw stems from the use of predictable charging station identifiers as session tokens, creating a fundamental weakness in the authentication and authorization framework. When multiple endpoints attempt to connect using identical session identifiers, the system fails to maintain proper session isolation, leading to a dangerous scenario where legitimate connections can be displaced by newer ones. The vulnerability specifically affects the session management layer that should enforce unique session binding but instead permits concurrent access with identical identifiers, violating core security principles of session uniqueness and integrity.
The technical implementation flaw manifests as a predictable session identifier generation mechanism that does not incorporate sufficient entropy or randomization elements. This predictable nature allows attackers to anticipate and potentially pre-generate session tokens, enabling them to establish connections that will supersede legitimate charging station sessions. The system's inability to properly track and validate session ownership creates a race condition where the most recent connection automatically takes precedence, effectively shadowing the original session. This behavior directly maps to CWE-305 authentication bypass vulnerabilities and represents a failure in session management controls that should prevent concurrent access with identical identifiers.
The operational impact of this vulnerability extends beyond simple session hijacking to encompass broader security and availability concerns. Unauthorized users can potentially authenticate as legitimate charging stations, gaining access to backend commands and system controls intended only for authorized devices. This authentication bypass capability allows malicious actors to manipulate charging sessions, potentially causing financial loss through unauthorized energy consumption or service disruption. The system's susceptibility to shadowing attacks creates a denial-of-service condition where legitimate charging stations are repeatedly displaced by malicious connections, effectively preventing them from performing their intended functions. This scenario aligns with ATT&CK technique T1566 for credential harvesting and T1499 for endpoint denial of service, creating a multi-vector attack surface.
Mitigation strategies must address both the immediate session management flaw and the underlying predictable identifier generation mechanism. The most critical remediation involves implementing cryptographically secure random number generation for session identifiers, ensuring sufficient entropy to prevent predictability. Session binding should enforce strict uniqueness constraints where duplicate identifiers trigger immediate connection rejection rather than session displacement. Additionally, implementing session timeout mechanisms and connection tracking systems will prevent indefinite session shadowing. Network-level controls including IP address validation and device authentication through certificates or tokens should supplement the backend session management. The solution must also include monitoring and alerting for suspicious session replacement patterns, enabling rapid detection of potential exploitation attempts. Proper implementation of these controls will address the root cause while maintaining system functionality and user experience.