CVE-2026-27649

High

Published: 20 March 2026

Published

20 March 2026

Modified

06 May 2026

KEV Added

—

Patch

—

CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0005 14.1th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27649 is a high-severity Insufficient Session Expiration (CWE-613) vulnerability in Ctek Charge Portal. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Web Session Cookie (T1550.004); ranked at the 14.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-10 (Concurrent Session Control) and IA-3 (Device Identification and Authentication).

Threat & Defense at a Glance

What attackers do: exploitation maps to Web Session Cookie (T1550.004) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-10 Concurrent Session Control good match

prevent

Directly prevents session hijacking and shadowing by limiting concurrent sessions per charging station identifier, blocking multiple endpoints from displacing legitimate connections.

IA-3 Device Identification and Authentication good match

prevent

Requires authentication of charging station devices before session association, stopping unauthorized endpoints from using predictable identifiers to impersonate legitimate stations.

SC-23 Session Authenticity good match

prevent

Enforces authenticity mechanisms for WebSocket communications sessions, mitigating displacement and interception of backend commands by unauthorized connections.

MITRE ATT&CK Enterprise TechniquesAI

T1550.004 Web Session Cookie Lateral Movement

Adversaries can use stolen session cookies to authenticate to web applications and services.

attack.mitre.org →

T1563 Remote Service Session Hijacking Lateral Movement

Adversaries may take control of preexisting sessions with remote services to move laterally in an environment.

attack.mitre.org →

Why these techniques?

Predictable/reusable WebSocket session IDs directly enable hijacking of active sessions for unauthorized access (T1550.004 Web Session Cookie) and remote service session takeover (T1563), with secondary flooding for DoS.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection…

displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

Deeper analysisAI

CVE-2026-27649 is a vulnerability in the WebSocket backend of charging station management systems, where charging station identifiers are used to associate sessions but permit multiple endpoints to connect using the same session identifier. This design flaw produces predictable session identifiers, facilitating session hijacking or shadowing. In such scenarios, the most recent connection displaces the legitimate charging station, intercepting backend commands intended for it. The issue carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and is associated with CWE-613.

The vulnerability is exploitable over the network by unauthenticated attackers with low complexity. An attacker can connect using a known or predictable session identifier to hijack an active session, enabling unauthorized authentication as other users or receipt of commands meant for legitimate stations. Alternatively, a malicious actor can overwhelm the backend with valid session requests, resulting in a denial-of-service condition that disrupts operations.

CISA's ICS Advisory ICSA-26-078-06, along with the corresponding CSAF file on GitHub and CTEK support resources, detail mitigations, patches, and remediation steps for affected systems.