CVE-2026-27647 is a high severity flaw (CVSS 7.3) in the mobility46.se charging backend. Sessions are tied to the station identifier, so a second connection with the same identifier can displace the real station and receive its commands. CISA lists all versions as affected and no vendor fix.
What's affected
The CISA advisory ICSA-26-057-08 lists all versions of mobility46.se as affected. It covers four CVEs in the same product, including this one. The record says the WebSocket backend uses charging station identifiers to uniquely associate sessions, yet allows several endpoints to connect with the same identifier.
CISA says Mobility46 did not respond to its request for coordination, and points readers to the vendor contact page. No fixed version is given. Treat the product as unpatched until the vendor says otherwise.
How to check if you're exposed
If you operate charging stations or a charging network that uses this backend, you are in scope.
- Ask your vendor or integrator whether you run mobility46.se.
- Ask what authentication protects the station WebSocket endpoint.
- Check backend logs for several connections presenting the same station identifier, or stations that go offline and reconnect unexpectedly.
What to do now
- Contact Mobility46 through the vendor contact page referenced by CISA and ask for a fix timeline.
- Restrict who can reach the station WebSocket endpoint, using network controls such as allow lists or a VPN, where your deployment allows it.
- Monitor for duplicate station identifiers, and alert on a station being displaced.
- Rate limit connection attempts at the edge to reduce the denial of service angle the record mentions.
- Follow the CISA guidance on defending industrial control systems, and keep this on your ICS risk register.
Why it matters
The record maps this to CWE-613, insufficient session expiration. Session identifiers that are predictable, and that a newer connection can take over, mean the most recent connection to claim an identifier wins. The legitimate charger loses its session and the impostor receives the backend commands meant for it.
The record says the result may let an unauthorised user authenticate as another user, or let someone overwhelm the backend with valid session requests. CISA's summary of the full advisory describes possible unauthorised administrative control of stations or disruption of charging services.
Charging networks are part of the energy and transport sectors, which is why CISA covers them. With no vendor fix published, defence is about network exposure and detection.
Quick check
Is there a patch?
The CISA advisory lists no vendor fix and says the vendor did not respond. Ask Mobility46 directly.
Sources
Last reviewed: 19 October 2026.
