The Mobility46 WebSocket backend is vulnerable to session hijacking and denial of service due to predictable session identifiers, allowing unauthorized actors to intercept backend communication.

This vulnerability, categorized as CWE-613, stems from the backend failing to enforce unique session associations, allowing unauthenticated attackers to hijack or shadow active charging station sessions. By connecting with a known identifier, an attacker can displace legitimate sessions and intercept commands intended for the original device.

The ability to hijack charging station sessions poses significant risks to operational integrity and service availability. An attacker can perform unauthorized actions, potentially leading to the manipulation of charging infrastructure or causing a denial of service by flooding the backend with conflicting session requests. With a CVSS score of 7.3, this flaw represents a high risk to the availability and management of connected charging hardware.

Immediate Action: Contact Mobility46 support or consult official vendor advisories to determine if a patch or configuration change has been released for your specific deployment.

Proactive Monitoring: Review backend logs for multiple concurrent connections using identical session identifiers or sudden, unexpected disconnections of charging stations.

Compensating Controls: Implement strict network access controls or a Web Application Firewall (WAF) to filter unauthorized WebSocket traffic and limit the origin of connection requests to known, trusted IP ranges.

Public Exploit Available: No

The severity of this vulnerability necessitates immediate attention, particularly for organizations managing critical charging infrastructure. As no public patch is currently confirmed, administrators should prioritize network segmentation and enhanced monitoring of WebSocket traffic to mitigate the risk of session hijacking until the vendor provides a secure update.