CVE-2026-27647: Mobility46 mobility46.se Insufficient Session Expiration in WebSocket Backend
CVE-2026-27647 affects the Mobility46 mobility46.se WebSocket backend, which uses charging station identifiers to associate sessions and allows multiple endpoints to connect with the same session identifier. According to the record, this can let a newer connection displace the legitimate charging station and receive its backend commands. The CVSS 3.1 base score in the record is 9.8 (critical), and no confirmed exploitation is reported in the sources consulted.
Overview
CVE-2026-27647 is a session management weakness in the WebSocket backend of Mobility46 mobility46.se. The backend relies on charging station identifiers to tie sessions together, and it accepts more than one endpoint connecting under the same session identifier. The record classifies the underlying weakness as CWE-613 (Insufficient Session Expiration).
Impact
According to the record, the most recent connection can displace the legitimate charging station and receive backend commands meant for that station. The description also states that the flaw may allow unauthorized users to authenticate as other users, and that a malicious actor could cause a denial-of-service condition by overwhelming the backend with valid session requests.
Affected products and versions
- Product: Mobility46 Mobility46.se
- The source does not specify version numbers. The record lists "versions not specified by the source" and "All versions" without any defined version strings.
- No fixed version is listed in the record. This does not mean no fix exists; it means the information is not available in the record.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so no active exploitation can be confirmed from the sources consulted. The SSVC fields in the record indicate exploitation as "none" and automatable as "yes". The EPSS probability is 0.0061.
Remediation and mitigation
- Check the vendor contact page referenced in the record and ask Mobility46 for an update or guidance for mobility46.se.
- Review the CISA ICS advisory referenced in the record for coordinated guidance.
- Until a vendor fix is confirmed, restrict network exposure of the WebSocket backend to trusted charging station networks and administrative paths.
- Monitor the backend for duplicate or unexpected connections that reuse an existing station identifier.
Detection guidance
- Log connection events and flag cases where a second endpoint registers a session identifier already in use.
- Watch for unexpected changes in which endpoint receives commands for a given charging station.
- Track spikes in session creation requests that could indicate resource exhaustion.
Limitations of the available information
The record gives a CVSS 3.1 base score of 9.8 from NVD, along with other scores from CISA-related providers (7.3 under CVSS 3.1 and 6.9 under CVSS 4.0). The record does not specify affected version strings, fixed versions, or vendor patch details. The exact protocol and implementation details are not described beyond the summary above.
Frequently asked questions
What is the core weakness in CVE-2026-27647?
The WebSocket backend lets multiple endpoints connect using the same session identifier, so a newer connection can displace the legitimate charging station. The record classifies this as CWE-613.
Is this CVE known to be actively exploited?
No. The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted.
Which versions are affected?
The record does not specify version strings. It only lists the product as affecting all versions, without defined version numbers or a fixed version.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.