The WebSocket backend associates charging station identifiers with sessions but permits multiple endpoints to use the same session identifier, creating a predictable scheme that enables session hijacking or shadowing. An attacker can displace a legitimate station and issue backend commands intended for that station, or flood the backend with valid session requests to cause a denial‑of‑service condition.

This flaw affects IGL‑Technologies eParking.fi devices that run the unencrypted deployment of their OCPP servers. Devices using the encrypted deployment or IGL‑Technologies’ proprietary eTolppa protocol are not impacted. No specific version information is provided.

With a CVSS score of 6.9 the flaw is of moderate severity. EPSS data is not available and it is not listed in the CISA KEV catalog, which suggests a lower likelihood of widespread exploitation yet still warrants attention. An attacker with network access to the WebSocket interface could predict or guess a session identifier, hijack or shadow the session, and gain unauthorized control or disrupt service. The vendor’s update introduces modern security profiles, stronger authentication, device‑level whitelisting, rate limiting, and enhanced monitoring to mitigate these risks.