A critical session hijacking vulnerability exists in the Chargemap WebSocket backend that permits unauthorized actors to impersonate legitimate charging stations or disrupt service operations.

The vulnerability is a session fixation or insufficient session expiration issue (CWE-613) where the system fails to uniquely validate session identifiers. An unauthenticated attacker can connect to the backend using a valid charging station identifier to displace legitimate sessions or intercept backend commands.

The ability for an unauthorized party to hijack charging station sessions poses significant risks to operational integrity and service availability. Successful exploitation allows attackers to perform command injection or trigger a denial of service by overwhelming the backend, which could lead to widespread disruption of charging infrastructure. Given the CVSS score of 7.3, this flaw is classified as High severity due to its potential for remote exploitation without user interaction.

Immediate Action: Monitor official Chargemap security channels for the release of a patch and apply updates immediately upon availability.

Proactive Monitoring: Review WebSocket access logs for anomalous patterns, such as multiple concurrent connections using identical session identifiers or frequent session displacement errors.

Compensating Controls: Implement stricter network-level access controls and rate limiting on the WebSocket gateway to detect and block multiple connection attempts originating from disparate IP addresses for the same session ID.

Public Exploit Available: Unknown

Chargemap users must prioritize the mitigation of this session management flaw to prevent unauthorized access and service disruption. Organizations should review their current deployment configurations to identify potential exposure and ensure that incident response teams are alerted to any unusual WebSocket activity until a permanent vendor patch is deployed.