A critical session management flaw in the CloudCharge backend allows unauthenticated attackers to hijack or displace legitimate charging station sessions.

This vulnerability is a session fixation and hijacking issue (CWE-613) where the WebSocket backend fails to properly validate unique session identifiers. An unauthenticated attacker can connect using a known identifier, effectively displacing the legitimate charging station and intercepting backend commands.

The ability to hijack charging station sessions poses significant operational risks, including potential unauthorized control over charging infrastructure and denial of service. With a CVSS score of 7.3, this high-severity vulnerability could lead to widespread service disruption and loss of management control over connected charging assets.

Immediate Action: Contact the vendor immediately via the support channel at https://cloudcharge.tech/support/contact/ to obtain the latest security guidance, as a specific public patch version is not currently provided.

Proactive Monitoring: Review backend access logs for multiple concurrent connections using the same charging station identifier, which may indicate active session hijacking attempts.

Compensating Controls: Implement network-level restrictions or VPN requirements for charging station backend communication to limit the exposure of the WebSocket interface to unauthorized entities.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the potential for unauthorized control of critical infrastructure, operators must treat this vulnerability with high priority. We recommend immediate engagement with the vendor to verify if a firmware or software update is available and to confirm the necessary configuration changes to enforce secure session binding.