SteVe, an open-source EV charging station management system, contains a flaw in its authentication logic for the StopTransaction message (CWE‑284). The system verifies only the transaction ID and whether the transaction exists, without checking that the requesting charger is the one that initiated that transaction. Consequently, any authenticated charger— and, due to a separate exposure of unprotected SOAP endpoints, even an unauthenticated requester—can stop any other charger's active session. This permits an attacker to disrupt charging, potentially causing financial loss or safety concerns, and represents an unauthorized control over a critical operational function.

The vulnerability affects steve-community’s SteVe product, versions up to and including 3.11.0. Administrators running these releases should verify whether their deployment includes any of the affected builds.

The CVSS score of 5.7 indicates a moderate severity, but the EPSS score of less than 1 % suggests a low likelihood of widespread exploitation at this time. Penetration of the vulnerability requires only knowledge of a chargeBoxId and the ability to issue a StopTransaction command; enumeration of sequential transaction IDs is trivial. Because the flaw can be exercised without prior authentication (provided FTP/ SOAP endpoints are not protected), the attack vector is effectively remote network access. The CNA notes that the issue is not present in the CISA KEV catalog, indicating it has not yet been widely exploited. Nonetheless, the potential to disrupt charging services warrants prompt remediation.