CVE-2026-24912: WebSocket Backend Auth Bypass Vulnerability

CVE-2026-24912 Overview

CVE-2026-24912 is a session hijacking vulnerability affecting WebSocket backend implementations used in electric vehicle (EV) charging station infrastructure. The vulnerability stems from the backend's use of predictable charging station identifiers to associate sessions, combined with a flawed design that permits multiple endpoints to connect using the same session identifier. This architectural weakness enables session hijacking or shadowing attacks, where an attacker's connection can displace a legitimate charging station and intercept backend commands intended for that station.

Critical Impact

Attackers can hijack charging station sessions to impersonate legitimate stations, intercept backend commands, or cause denial-of-service conditions by overwhelming the backend with valid session requests.

Affected Products

• ePower WebSocket Backend (specific versions not disclosed)
• EV Charging Station Management Systems using predictable session identifiers

Discovery Timeline

• 2026-03-06 - CVE-2026-24912 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-24912

Vulnerability Analysis

This vulnerability is classified under CWE-613 (Insufficient Session Expiration), though the root issue extends beyond session expiration to include predictable session identifiers and improper session management. The WebSocket backend architecture fails to implement proper session isolation, allowing multiple connections to share or override the same session identifier based on charging station identifiers.

When a new connection is established using an existing session identifier, the backend does not properly validate the connection's authenticity or maintain the original session. Instead, the most recent connection displaces the legitimate one, effectively taking control of the session. This behavior creates two primary attack scenarios: authentication bypass where attackers impersonate legitimate charging stations, and denial-of-service through session flooding.

Root Cause

The fundamental weakness lies in the session management design. The backend relies solely on charging station identifiers as session keys without implementing additional authentication factors or connection validation. This approach assumes that possession of the identifier equates to legitimate access—a dangerous assumption in networked environments where identifiers may be enumerable or discoverable through reconnaissance.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker with knowledge of valid charging station identifiers can establish a WebSocket connection to the backend using a target station's identifier. Upon successful connection, the attacker's session displaces the legitimate station's connection, allowing the attacker to receive backend commands intended for that station.

The attack can be escalated to denial-of-service by flooding the backend with connections using valid or enumerated session identifiers, disrupting service for multiple charging stations simultaneously.

Detection Methods for CVE-2026-24912

Indicators of Compromise

• Unexpected WebSocket disconnections from legitimate charging stations followed by rapid reconnections from different source IP addresses
• Multiple concurrent connection attempts using identical charging station identifiers from disparate geographic locations
• Unusual patterns of session establishment where new connections immediately displace existing valid sessions
• Backend logs showing repeated session takeovers for the same station identifier within short time windows

Detection Strategies

• Implement session anomaly detection to identify when established connections are unexpectedly terminated and replaced
• Monitor WebSocket connection metadata for geographic or network inconsistencies between expected station locations and connection sources
• Deploy network-level inspection to detect enumeration attempts against charging station identifiers
• Configure alerts for high-frequency session establishment attempts that may indicate flooding attacks

Monitoring Recommendations

• Enable detailed logging of all WebSocket session establishment and termination events with source IP correlation
• Establish baseline connection patterns for each charging station to facilitate anomaly detection
• Monitor backend resource utilization for signs of session flooding denial-of-service attempts
• Implement real-time alerting for session hijacking patterns across the charging network infrastructure

How to Mitigate CVE-2026-24912

Immediate Actions Required

• Contact ePower support through their Support Resources for vendor-specific guidance and patches
• Review the CISA ICS Advisory ICSA-26-062-07 for official mitigation recommendations
• Implement network segmentation to isolate charging station backend communications from untrusted networks
• Enable enhanced logging and monitoring on WebSocket backend infrastructure to detect exploitation attempts

Patch Information

Consult the vendor's official advisory and support channels for patch availability. The CISA ICS Advisory provides authoritative guidance on remediation steps. Additional technical details are available in the GitHub CSAF File.

Workarounds

• Implement additional authentication layers beyond station identifiers, such as mutual TLS or API keys, to validate connection legitimacy
• Deploy rate limiting on WebSocket connection establishment to mitigate session flooding attacks
• Restrict backend access to known IP ranges or implement VPN requirements for charging station communications
• Consider implementing session binding that ties sessions to specific network characteristics that cannot be easily spoofed

# Example: Network-level mitigation using firewall rules to restrict WebSocket backend access
# Restrict access to known charging station IP ranges only
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP