Session Hijacking Vulnerability in E-Power Charging Stations
CVE-2026-24912

6.9MEDIUM

Key Information:

Vendor

Epower

Status
Epower.ie
Vendor
CVE Published:
5 March 2026

What is CVE-2026-24912?

The E-Power charging stations exhibit a significant vulnerability in their WebSocket backend, which utilizes charging station identifiers to manage session associations. However, the flawed implementation permits multiple endpoints to connect using identical session identifiers. This leads to predictable session identifiers, enabling potential session hijacking or shadowing. In this scenario, when a new connection is established, it can displace the legitimate charging station, receiving backend commands meant for it. Such vulnerabilities expose the system to unauthorized authentication and may allow malicious actors to flood the backend with session requests, resulting in denial-of-service conditions.

Affected Version(s)

epower.ie All versions

References

https://epower.ie/support/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-0...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA.
.