The vulnerability arises because the WebSocket backend uses predictable charging station identifiers as session keys without restricting multiple endpoints from using the same ID. This flaw allows an attacker to infer or guess a valid session identifier and establish a connection that shadows or replaces a legitimate station, enabling the attacker to receive backend commands intended for that station. In addition, the permissive reuse of session identifiers can be exploited to flood the backend with valid session requests, causing a denial‑of‑service. The impact includes unauthorized control of charging stations, potential financial loss, and service interruption, while the confidentiality and integrity of backend communications are compromised.

All EV2GO installations that use the ev2go.io WebSocket backend are affected. No specific product versions are listed, so the risk applies broadly to any deployment of EV2GO that employs the session‑identification scheme described. Users with legacy deployments should verify whether the backend uses predictable session identifiers.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is below 1 %, suggesting a low likelihood of widespread exploitation. The vulnerability is not present in the CISA KEV catalog. The attack requires remote network access to the WebSocket endpoint and the ability to guess or predict a valid session identifier; thus, it is inferred to be a remote, network‑level attack vector. Once a session identifier is obtained, the attacker can hijack or shadow an existing session, or overwhelm the backend by repeatedly requesting new sessions, leading to denial of service.