CVE-2026-27649
Last modified
CVE-2026-27649 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ctek | Charge Portal | All versions |
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-06Third Party Advisory, US Government Resource
- https://www.ctek.com/supportProduct
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-27649?
How severe is CVE-2026-27649?
How do I fix CVE-2026-27649?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-27643free5GC UDR is the user data repository (UDR) for free5GC, a…5.3
- CVE-2026-27644Traccar is an open source GPS tracking system. In versions b…6.5
- CVE-2026-27645changedetection.io is a free open source web page change det…6.1
- CVE-2026-27646OpenClaw versions prior to 2026.3.7 contain a sandbox escape…6.1
- CVE-2026-27647The WebSocket backend uses charging station identifiers to u…9.8
- CVE-2026-27648in OpenHarmony v6.0 and prior versions allow a remote attack…8.8
- CVE-2026-2765Use-after-free in the JavaScript Engine component. This vuln…9.8
- CVE-2026-27650OS Command Injection vulnerability exists in BUFFALO Wi-Fi r…9.8
- CVE-2026-27651When the ngx_mail_auth_http_module module is enabled on NGIN…8.7
- CVE-2026-27652The WebSocket backend uses charging station identifiers to u…7.5
- CVE-2026-27653The installers for multiple products provided by Soliton Sys…6.7
- CVE-2026-27654NGINX Open Source and NGINX Plus have a vulnerability in the…8.8
Are you affected by CVE-2026-27649?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST