CVE-2026-24912

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published
Mar 6, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-249138.7SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, information stored in the databaCVE-2026-249145.5Type confusion vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249157.1Out-of-bounds read issue in the media subsystem. Impact: Successful exploitation of this vulnerability will affect availability and confidenCVE-2026-249165.5Identity authentication bypass vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service CVE-2026-249175.5UAF vulnerability in the security module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249185.5Address read vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249195.5Out-of-bounds write vulnerability in the DFX module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-24927.8TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackersCVE-2026-249205.5Permission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249217.1Address read vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiaCVE-2026-249225.5Buffer overflow vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249235.5Permission control vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect service confidentiality
CVE-2026-24912: High severity, CVSS 8.6 | Vulnix