The CTEK Chargeportal WebSocket backend uses charging station identifiers as session identifiers but allows multiple endpoints to connect with the same identifier. This design flaw makes session IDs predictable and allows an attacker to hijack or shadow an existing session. As a result, authenticating users can be impersonated or overridden, giving the malicious party control over backend commands intended for the legitimate station, and potentially causing a denial‑of‑service condition by flooding the backend with valid session requests. The weakness is a classic example of Inadequate Session Expiration (CWE‑613).

All deployments of the CTEK Chargeportal product are potentially vulnerable; no specific version information is listed, so any installation remains at risk until remediated.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting that no widespread exploitation has been reported yet. Based on the description, it is inferred that the attack vector is remote via the WebSocket endpoint, requiring only network access to the server to establish a connection and predict or observe a valid session identifier. Successful exploitation could allow an attacker to assume control of a charging station or disrupt backend operations, but it would not grant full system takeover without additional privilege escalation. The overall risk is moderate, pending the availability of a vendor patch or product deprecation plan.