EVMAPA Insufficient Session Expiration Vulnerability Allowing Concurrent Connections with the Same Charging Station ID

A vulnerability in EVMAPA exists due to inadequate session management, allowing multiple simultaneous connections to the backend using the same charging station ID. This flaw can lead to unauthorized access, data inconsistencies, and potential manipulation of charging sessions. Attackers can exploit this vulnerability by reusing valid charging station IDs to create multiple concurrent sessions.

Impact

Exploitation of this vulnerability could result in unauthorized access, data inconsistencies, and manipulation of charging session statuses.

Remediation

EVMAPA has informed CISA that this issue has been resolved by preventing simultaneous connections from charging stations using the same CBID.