CVE-2026-24912 Unknown Vendor CVE debrief

Who should care

Operators and maintainers of ePower epower.ie deployments, especially environments where charging stations communicate over WebSocket backends. Security teams responsible for OT/ICS-connected charging infrastructure should treat this as a high-priority identity and availability issue.

Technical summary

According to the CISA CSAF advisory, the backend uses charging-station identifiers to uniquely associate sessions, but it does not enforce uniqueness for connected endpoints. That design makes session identifiers predictable and allows a later connection to supersede an existing one. The practical impact is session shadowing/hijacking, where backend commands intended for one station can be routed to another connection, plus potential service disruption when valid session requests are overwhelmed. CISA lists the issue with CVSS v3.1 7.3 (HIGH) and the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

Defensive priority

High. The issue is network-reachable, requires no privileges or user interaction, and can affect confidentiality, integrity, and availability. In connected charging or OT environments, loss of session integrity can directly impact operational control and uptime.

Recommended defensive actions

• Review whether any ePower epower.ie deployment is in use and treat all versions covered by the advisory scope as potentially affected.
• Contact ePower via the vendor support page for remediation guidance and monitor for a vendor fix or coordinated update.
• Restrict access to the WebSocket backend to trusted network paths only, using segmentation and firewall controls.
• Monitor for duplicate charging-station identifiers, unexpected session replacement, or repeated valid session requests that could indicate shadowing or denial-of-service activity.
• Apply CISA ICS recommended practices and defense-in-depth guidance for segmentation, least privilege, monitoring, and incident response around OT-facing services.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-26-062-07 for CVE-2026-24912, published 2026-03-03 with an initial revision. The advisory text explicitly states that multiple endpoints can connect using the same session identifier, leading to predictable identifiers and session shadowing/hijacking. It also states that ePower did not respond to CISA's request for coordination. The advisory includes CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (score 7.3) and an SSVCv2 note dated 2026-03-02T06:00:00Z; that SSVC timestamp is not treated as the CVE publication date.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.