The vulnerability arises because the WebSocket backend uses charging station identifiers as session identifiers and permits multiple endpoints to connect with the same identifier. Because the session IDs are predictable and not bound to a single device, an attacker can hijack an active session or shadow an existing one, causing commands intended for a legitimate station to be executed by the attacker. This session hijacking leads to unauthorized authentication, allowing an attacker to act as another station, or to use the back‑end as a vector for denial of service by flooding the system with valid session requests.

The affected product is Mobility46 mobility46.se. No specific affected version information is provided in the CVE entry, so all deployed instances of this product should be considered potentially vulnerable.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1 % suggests a very low probability of being exploited in the wild. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The likely attack vector involves an attacker establishing a WebSocket connection to the backend and supplying a predictable session identifier. Once connected, the attacker can hijack or shadow an existing session, which may enable unauthorized control of a charging station or induce a denial‑of‑service condition. Because the vendor did not publicly provide a patch or coordinate with CISA, the risk depends largely on the exposure of the WebSocket endpoint.