CVE-2026-27647 in Mobility46
Summary
by MITRE • 02/27/2026
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/06/2026
This vulnerability resides in the WebSocket backend implementation of charging station communication systems where session management flaws create significant security risks. The core issue stems from the backend's reliance on charging station identifiers as unique session tokens, which are predictable and susceptible to exploitation. When multiple endpoints connect using identical session identifiers, the system fails to properly validate or track concurrent connections, creating opportunities for session hijacking and shadowing attacks.
The technical flaw manifests in the lack of proper session validation mechanisms and predictable identifier generation. Charging station identifiers are generated in a manner that makes them guessable or enumerable, allowing attackers to create sessions with the same identifiers as legitimate stations. This predictable pattern violates fundamental security principles for session management and creates a race condition where the most recent connection automatically displaces the previous legitimate connection. The backend system does not maintain proper state tracking or authentication validation to prevent such conflicts, enabling unauthorized access to charging station controls and data.
From an operational impact perspective, this vulnerability creates multiple attack vectors that can compromise both system integrity and availability. Session hijacking allows malicious actors to impersonate legitimate charging stations and execute unauthorized commands, potentially leading to unauthorized charging operations, billing manipulation, or data exfiltration. The shadowing capability enables denial-of-service conditions where legitimate stations are displaced by malicious connections, causing service interruption and operational disruption. Additionally, the predictable session identifiers make automated attack tools effective, reducing the effort required for exploitation and increasing the likelihood of successful attacks.
The vulnerability directly relates to CWE-305 Authentication Bypass Through User Identification, CWE-307 Improper Restriction of Excessive Authentication Attempts, and CWE-287 Improper Authentication. It aligns with ATT&CK techniques including T1110.003 Credential Access: Password Cracking and T1499.004 Network Denial of Service. The implementation fails to follow secure session management practices as outlined in NIST SP 800-63B and OWASP Session Management Cheat Sheet. Organizations should implement proper session validation, unique identifier generation, and concurrent connection handling to prevent this vulnerability. Recommended mitigations include implementing random session identifiers, maintaining proper session state tracking, enforcing connection validation, and implementing rate limiting to prevent session flooding attacks.
The security implications extend beyond immediate exploitation as this vulnerability can enable broader attacks within charging station networks. Attackers can use the compromised sessions to gain persistent access to charging infrastructure, potentially leading to data breaches, financial losses, or operational disruption. The vulnerability also creates opportunities for lateral movement within connected systems, as compromised charging stations can serve as entry points for attacking other network components. Organizations must also consider the regulatory implications of such vulnerabilities, as they may violate compliance requirements for critical infrastructure protection and data security standards.
Mitigation strategies should include immediate implementation of secure session identifier generation using cryptographically secure random number generators, proper session state management with expiration mechanisms, and enforcement of unique connection validation. Network segmentation and monitoring should be implemented to detect anomalous connection patterns and potential exploitation attempts. Regular security assessments should verify that session management implementations meet established security standards and that no similar vulnerabilities exist in related systems. The vulnerability highlights the importance of proper authentication and session management in IoT environments where device identity and secure communication are critical for operational safety and security.