A critical session management flaw in EVMAPA software allows unauthenticated attackers to hijack or manipulate charging sessions by reusing valid station identifiers.

This vulnerability is a session management error (CWE-613) where the backend fails to invalidate or restrict concurrent connections for the same charging station ID. An unauthenticated attacker can exploit this weakness to establish unauthorized sessions.

The ability to manipulate charging sessions poses a direct threat to service integrity and operational reliability. Successful exploitation could lead to unauthorized access to charging infrastructure, financial discrepancies, or the intentional disruption of energy delivery, justifying the 7.3 CVSS score as a High-severity risk.

Immediate Action: Contact the vendor or consult the CISA advisory ICSA-26-022-08 to verify the availability of the specific update that enforces unique charging station connection constraints.

Proactive Monitoring: Monitor backend logs for multiple concurrent connections originating from the same charging station ID or anomalous session behavior.

Compensating Controls: Implement network-level segmentation or source IP filtering to restrict connections to trusted charging hardware until software updates are applied.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for unauthorized session manipulation, organizations utilizing EVMAPA software must prioritize the implementation of the vendor-provided fix. Verify current configurations to ensure that session management policies are strictly enforced and monitor for any signs of session reuse or unauthorized connection attempts.