The WebSocket backend uses charging station identifiers to bind sessions to specific stations, but the design does not enforce unique session usage. Because session identifiers are predictable and multiple endpoints can connect with the same identifier, an attacker can replay a valid session ID to gain access. This allows the attacker to hijack the active session or shadow the legitimate charging station, thereby receiving commands that were intended for the other station. The weakness is a CWE‑613 defect in session management that permits unauthorized authentication and can lead to denial‑of‑service by flooding the backend with hijacked session requests.

The affected entity is SWITCH EV from swtchenergy.com. The vulnerability resides in the WebSocket backend that handles charging station sessions. No specific product version information is provided, so any deployment of this backend component may be susceptible.

With a CVSS score of 6.9 the severity is moderate, and an EPSS score of less than 1% indicates a low likelihood of exploitation. The issue is not currently listed in CISA’s KEV catalog. The likely attack vector is network‑based: an attacker establishes a WebSocket connection to the backend and supplies a predictable session identifier, then hijacks the session or triggers denial‑of‑service by overloading the system with valid session creations.