CVE-2026-32663

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
IGL-Technologies	eParking.fi	All versions

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.jsonNot Applicable
https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08Not Applicable

Timeline

Published: Mar 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-326657.5In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams CVE-2026-326667.5WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does not implement additi CVE-2026-326678.5Out-of-bounds write for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation of privilege. Unprivi CVE-2026-326699.8Code injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary code may be executed CVE-2026-326708.5Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation CVE-2026-326726.8Null pointer dereference for the Intel(R) NPU Drivers before version 32.0.100.4778 within Ring 1: Device Drivers may allow a denial of servi CVE-2026-326738.7A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator CVE-2026-326777.3Path traversal for some gaudi-container-runtime before version 1.24.0 within Ring 3: User Applications may allow an escalation of privilege.CVE-2026-326788.7Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings wi CVE-2026-326798.4The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the installers of Canon CVE-2026-32684.3A vulnerability was detected in psi-probe PSI Probe up to 5.3.0. The affected element is an unknown function of the file psi-probe-core/src/CVE-2026-326808.5The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder. If the installation folder is custom