CVE-2026-27647 (GCVE-0-2026-27647)

Vulnerability from cvelistv5 – Published: 2026-02-27 00:23 – Updated: 2026-02-27 00:23
VLAI?
Title
Mobility46 mobility46.se Insufficient Session Expiration
Summary
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
Severity ?
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE
Assigner
References
Impacted products
Vendor Product Version
Mobility46 mobility46.se Affected: All versions
Create a notification for this product.
Credits
Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "mobility46.se",
          "vendor": "Mobility46",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The WebSocket backend uses charging station identifiers to uniquely \nassociate sessions but allows multiple endpoints to connect using the \nsame session identifier. This implementation results in predictable \nsession identifiers and enables session hijacking or shadowing, where \nthe most recent connection displaces the legitimate charging station and\n receives backend commands intended for that station. This vulnerability\n may allow unauthorized users to authenticate as other users or enable a\n malicious actor to cause a denial-of-service condition by overwhelming \nthe backend with valid session requests."
            }
          ],
          "value": "The WebSocket backend uses charging station identifiers to uniquely \nassociate sessions but allows multiple endpoints to connect using the \nsame session identifier. This implementation results in predictable \nsession identifiers and enables session hijacking or shadowing, where \nthe most recent connection displaces the legitimate charging station and\n receives backend commands intended for that station. This vulnerability\n may allow unauthorized users to authenticate as other users or enable a\n malicious actor to cause a denial-of-service condition by overwhelming \nthe backend with valid session requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-27T00:23:50.315Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.mobility46.se/en/contact-us"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-08"
        },
        {
          "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-08.json"
        }
      ],
      "source": {
        "advisory": "ICSA-26-057-08",
        "discovery": "EXTERNAL"
      },
      "title": "Mobility46 mobility46.se Insufficient Session Expiration",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Mobility46 did not respond to CISA\u0027s request for coordination. Contact \nMobility46 using their contact page here: \n\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.mobility46.se/en/contact-us\"\u003ehttps://www.mobility46.se/en/contact-us\u003c/a\u003e for more information.\n\n\u003cbr\u003e"
            }
          ],
          "value": "Mobility46 did not respond to CISA\u0027s request for coordination. Contact \nMobility46 using their contact page here: \n https://www.mobility46.se/en/contact-us  for more information."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2026-27647",
    "datePublished": "2026-02-27T00:23:50.315Z",
    "dateReserved": "2026-02-24T00:35:18.446Z",
    "dateUpdated": "2026-02-27T00:23:50.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-27647\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2026-02-27T01:16:20.967\",\"lastModified\":\"2026-02-27T14:06:37.987\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The WebSocket backend uses charging station identifiers to uniquely \\nassociate sessions but allows multiple endpoints to connect using the \\nsame session identifier. This implementation results in predictable \\nsession identifiers and enables session hijacking or shadowing, where \\nthe most recent connection displaces the legitimate charging station and\\n receives backend commands intended for that station. This vulnerability\\n may allow unauthorized users to authenticate as other users or enable a\\n malicious actor to cause a denial-of-service condition by overwhelming \\nthe backend with valid session requests.\"},{\"lang\":\"es\",\"value\":\"El backend de WebSocket utiliza identificadores de estaciones de carga para asociar sesiones de forma \u00fanica, pero permite que m\u00faltiples puntos finales se conecten utilizando el mismo identificador de sesi\u00f3n. Esta implementaci\u00f3n resulta en identificadores de sesi\u00f3n predecibles y permite el secuestro o la suplantaci\u00f3n de sesi\u00f3n, donde la conexi\u00f3n m\u00e1s reciente desplaza a la estaci\u00f3n de carga leg\u00edtima y recibe comandos del backend destinados a esa estaci\u00f3n. Esta vulnerabilidad puede permitir a usuarios no autorizados autenticarse como otros usuarios o permitir que un actor malicioso cause una condici\u00f3n de denegaci\u00f3n de servicio al sobrecargar el backend con solicitudes de sesi\u00f3n v\u00e1lidas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":3.4}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-613\"}]}],\"references\":[{\"url\":\"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-08.json\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-08\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://www.mobility46.se/en/contact-us\",\"source\":\"ics-cert@hq.dhs.gov\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.