CTEK Chargeportal WebSocket Session Hijacking Vulnerability

A vulnerability in the WebSocket backend of CTEK Chargeportal allows multiple endpoints to connect using the same session identifier, leading to predictable session identifiers. This flaw enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and intercepts backend commands intended for that station. Additionally, this vulnerability could allow unauthorized users to authenticate as other users or enable a denial-of-service condition by overwhelming the backend with valid session requests.

Impact

Exploitation of this vulnerability could result in unauthorized administrative control over affected charging stations or disrupt charging services, causing a denial-of-service condition.

Remediation

CTEK will be sunsetting this product in April 2026. For more information, please contact CTEK support.