CVE-2026-32663: fallo de gravedad media en IGL-Technologies eParking.fi
IGL-Technologies eParking.fi Insufficient Session Expiration
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.3%
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
IGL-Technologies · eParking.fiCVEs relacionadas — IGL-Technologies eParking.fi
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-29796CRITICALIGL-Technologies eParking.fi Missing Authentication for Critical FunctionEPSS 0.5%CVE-2026-31903HIGHIGL-Technologies eParking.fi Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2026-31926MEDIUMIGL-Technologies eParking.fi Insufficiently Protected CredentialsEPSS 0.3%