A critical session management flaw in the EV2GO charging station backend allows unauthenticated attackers to hijack or shadow active sessions, posing a significant risk to operational integrity.

This vulnerability is a session fixation and hijacking issue (CWE-613) stemming from the use of predictable session identifiers. The flaw allows an unauthenticated attacker to displace legitimate charging station connections and intercept backend commands.

The ability to hijack charging station sessions can lead to unauthorized control over critical infrastructure, potentially resulting in service disruption or the manipulation of charging processes. With a CVSS score of 7.3, this high-severity vulnerability represents a substantial risk to service availability and system integrity, necessitating immediate attention to prevent unauthorized command execution.

Immediate Action: Monitor vendor communication channels closely for the release of a security patch and prepare to deploy it immediately upon availability.

Proactive Monitoring: Review backend WebSocket logs for multiple endpoints utilizing the same session identifier or frequent, anomalous session reconnection patterns.

Compensating Controls: Implement strict network access controls or VPN requirements for charging station backend communications to limit the attack surface while awaiting a permanent software update.

Public Exploit Available: Unknown

Given the potential for session hijacking and the lack of a current patch, administrators must treat this vulnerability with high priority. Organizations should isolate affected charging station management backends from public networks where possible and maintain vigilance for any signs of unauthorized session displacement until the vendor provides a remediation path.