A vulnerability in the ev.energy WebSocket backend allows unauthenticated attackers to hijack or displace legitimate charging station sessions, posing a risk of unauthorized command execution.

This is a session fixation or predictable session identifier issue (CWE-613) where the system allows multiple endpoints to connect using the same identifier. The vulnerability is exploitable by an unauthenticated attacker, allowing them to displace a legitimate station connection and intercept backend commands.

The ability for an unauthorized party to hijack charging station sessions can lead to significant service disruption and unauthorized control over energy infrastructure. With a CVSS score of 7.3, this flaw represents a high risk to operational integrity, potentially allowing attackers to issue arbitrary commands to charging hardware or cause a denial of service.

Immediate Action: Monitor official vendor advisories from ev.energy for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Review backend logs for anomalous connection patterns, specifically multiple concurrent connections originating from different sources using identical charging station identifiers.

Compensating Controls: Implement network-level restrictions or VPN access for charging station management interfaces to ensure that only trusted endpoints can communicate with the backend.

Public Exploit Available: Unknown

Given the high impact on session integrity and the ease of exploitation, organizations utilizing the ev.energy platform must treat this vulnerability with high priority. While a specific patch is not yet confirmed, administrators should engage with the vendor and restrict access to the affected backend services until a permanent fix is deployed.