A critical session management flaw in the CTEK Chargeportal allows attackers to hijack or shadow charging station sessions, potentially leading to unauthorized control or service disruption.

This is an insufficient session expiration (CWE-613) vulnerability where the backend fails to uniquely associate sessions with charging station identifiers. The flaw allows unauthenticated remote attackers to displace legitimate sessions or perform session shadowing by connecting with a known identifier.

The vulnerability carries a CVSS score of 7.3, indicating a high potential for operational disruption and unauthorized access. Successful exploitation permits an attacker to intercept backend commands intended for legitimate charging stations, potentially leading to service denial or the manipulation of critical infrastructure management functions.

Immediate Action: Monitor the CTEK support portal for the release of security updates or configuration patches and apply them immediately upon availability.

Proactive Monitoring: Review backend logs for multiple active connections sharing the same session identifier or anomalous authentication patterns originating from unexpected endpoints.

Compensating Controls: Implement network-level segmentation to restrict access to the WebSocket backend, ensuring only authorized charging station hardware can communicate with the server.

Public Exploit Available: No

Given the potential for session hijacking and the lack of an immediate patch, administrators must prioritize the protection of the Chargeportal management interface. Restrict network access to the backend infrastructure and remain vigilant for official remediation guidance from CTEK to mitigate this high-risk vulnerability.