{"id":"CVE-2025-55705","aliases":["EUVD-2026-4503","GHSA-857q-pww2-xgv7"],"status":"published","title":"EVMAPA Insufficient Session Expiration","description":"This vulnerability occurs when the system permits multiple simultaneous \nconnections to the backend using the same charging station ID. This can \nresult in unauthorized access, data inconsistency, or potential \nmanipulation of charging sessions. The lack of proper session management\n and expiration control allows attackers to exploit this weakness by \nreusing valid charging station IDs to establish multiple sessions \nconcurrently.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00333,"percentile":0.26899,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-613"],"published":"2026-01-22T22:32:48Z","modified":"2026-06-17T09:42:05Z","products":[{"vendor":"evmapa","product":"evmapa"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-08","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-022-08.json","tags":["Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55705"},{"url":"https://github.com/advisories/GHSA-857q-pww2-xgv7"}],"sources":{"cve":[{"id":"CVE-2025-55705","title":"EVMAPA Insufficient Session Expiration","description":"This vulnerability occurs when the system permits multiple simultaneous \nconnections to the backend using the same charging station ID. This can \nresult in unauthorized access, data inconsistency, or potential \nmanipulation of charging sessions. The lack of proper session management\n and expiration control allows attackers to exploit this weakness by \nreusing valid charging station IDs to establish multiple sessions \nconcurrently.","status":"published","published":"2026-01-22T22:32:48.138Z","modified":"2026-01-23T20:10:44.688Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:32:52.839698Z"}],"euvd":[{"id":"EUVD-2026-4503","description":"This vulnerability occurs when the system permits multiple simultaneous \nconnections to the backend using the same charging station ID. This can \nresult in unauthorized access, data inconsistency, or potential \nmanipulation of charging sessions. The lack of proper session management\n and expiration control allows attackers to exploit this weakness by \nreusing valid charging station IDs to establish multiple sessions \nconcurrently.","status":"published","published":"2026-01-22T22:32:48Z","modified":"2026-01-23T20:10:44Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:48:47.68467Z"}],"ghsa":[{"id":"GHSA-857q-pww2-xgv7","title":"This vulnerability occurs when the system permits multiple simultaneous \nconnections to the...","description":"This vulnerability occurs when the system permits multiple simultaneous \nconnections to the backend using the same charging station ID. This can \nresult in unauthorized access, data inconsistency, or potential \nmanipulation of charging sessions. The lack of proper session management\n and expiration control allows attackers to exploit this weakness by \nreusing valid charging station IDs to establish multiple sessions \nconcurrently.","status":"published","published":"2026-01-23T00:31:17Z","modified":"2026-01-23T00:31:18Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T15:05:52.452073Z"}],"nvd":[{"id":"CVE-2025-55705","description":"This vulnerability occurs when the system permits multiple simultaneous \nconnections to the backend using the same charging station ID. This can \nresult in unauthorized access, data inconsistency, or potential \nmanipulation of charging sessions. The lack of proper session management\n and expiration control allows attackers to exploit this weakness by \nreusing valid charging station IDs to establish multiple sessions \nconcurrently.","status":"published","published":"2026-01-22T23:15:50.137Z","modified":"2026-06-17T09:42:05.733Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:11:59.073638Z"}]}}