A critical session management flaw in Mobiliti e-mobi.hu allows unauthenticated attackers to hijack or shadow legitimate charging station sessions.

This vulnerability involves improper session handling (CWE-613) where the WebSocket backend uses predictable identifiers that allow multiple endpoints to share the same session. An unauthenticated attacker can displace a legitimate connection, effectively hijacking the session or causing a denial-of-service by overwhelming the backend.

The ability for an unauthorized party to hijack charging station sessions poses significant risks to service integrity and operational continuity. Because the vulnerability is automatable and allows for unauthorized command execution or system disruption, it could lead to widespread service outages and potential manipulation of charging infrastructure. The CVSS score of 7.3 reflects the high accessibility of this flaw, making it a priority for industrial control and utility-facing systems.

Immediate Action: Review the official CISA advisory (ICSA-26-062-06) and coordinate with Mobiliti for any available firmware or software security updates.

Proactive Monitoring: Monitor WebSocket traffic for anomalous connection patterns, such as multiple endpoints attempting to authenticate with identical session identifiers.

Compensating Controls: Implement network-level restrictions or VPN access to limit external exposure of the WebSocket backend until a permanent patch is deployed.

Public Exploit Available: Unknown

Given the potential for session hijacking in critical charging infrastructure, administrators must prioritize identifying exposed WebSocket endpoints. While a specific patch version remains unconfirmed, organizations should engage with the vendor immediately to secure their environments against unauthorized session access.