CVE-2026-25778: medium-severity vulnerability in SWITCH EV swtchenergy.com
SWITCH EV swtchenergy.com Insufficient Session Expiration
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.4%
The WebSocket backend uses charging station identifiers to uniquely
associate sessions but allows multiple endpoints to connect using the
same session identifier. This implementation results in predictable
session identifiers and enables session hijacking or shadowing, where
the most recent connection displaces the legitimate charging station and
receives backend commands intended for that station. This vulnerability
may allow unauthorized users to authenticate as other users or enable a
malicious actor to cause a denial-of-service condition by overwhelming
the backend with valid session requests.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
SWITCH EV · swtchenergy.comRelated CVEs — SWITCH EV swtchenergy.com
In the same product, most dangerous first.
CVE-2026-27767CRITICALSWITCH EV swtchenergy.com Missing Authentication for Critical FunctionEPSS 0.6%CVE-2026-25113HIGHSWITCH EV swtchenergy.com Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2026-27773MEDIUMSWITCH EV swtchenergy.com Insufficiently Protected CredentialsEPSS 0.3%