The WebSocket backend for ePower's epower.ie platform uses charging station identifiers as session IDs but permits multiple endpoints to connect with the same identifier. Because the session IDs are predictable, an attacker can hijack or shadow a legitimate session, causing the most recent connection to receive backend commands intended for the displaced station. This flaw can also be used to launch a denial‑of‑service by flooding the backend with valid session requests, ultimately disrupting charging station operations.

The vulnerability affects the ePower epower.ie charging station management platform. No specific product version is identified in the advisory, so all current and future deployments should be considered potentially susceptible until a vendor patch is issued.

The CVSS base score of 6.9 indicates medium severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker with network access to the WebSocket endpoint can construct a valid session identifier and establish a connection, thus hijacking the session or flooding the backend. The attack requires no privileged credentials and can be performed remotely, making it potentially impactful for operations that rely on the platform for charging infrastructure control.