CVE-2026-25778: fallo de gravedad media en SWITCH EV swtchenergy.com
SWITCH EV swtchenergy.com Insufficient Session Expiration
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.4%
The WebSocket backend uses charging station identifiers to uniquely
associate sessions but allows multiple endpoints to connect using the
same session identifier. This implementation results in predictable
session identifiers and enables session hijacking or shadowing, where
the most recent connection displaces the legitimate charging station and
receives backend commands intended for that station. This vulnerability
may allow unauthorized users to authenticate as other users or enable a
malicious actor to cause a denial-of-service condition by overwhelming
the backend with valid session requests.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
SWITCH EV · swtchenergy.comCVEs relacionadas — SWITCH EV swtchenergy.com
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-27767CRITICALSWITCH EV swtchenergy.com Missing Authentication for Critical FunctionEPSS 0.6%CVE-2026-25113HIGHSWITCH EV swtchenergy.com Improper Restriction of Excessive Authentication AttemptsEPSS 0.5%CVE-2026-27773MEDIUMSWITCH EV swtchenergy.com Insufficiently Protected CredentialsEPSS 0.3%