{"id":"CVE-2025-55705","state":"PUBLISHED","title":"EVMAPA Insufficient Session Expiration","description":"This vulnerability occurs when the system permits multiple simultaneous \nconnections to the backend using the same charging station ID. This can \nresult in unauthorized access, data inconsistency, or potential \nmanipulation of charging sessions. The lack of proper session management\n and expiration control allows attackers to exploit this weakness by \nreusing valid charging station IDs to establish multiple sessions \nconcurrently.","publishedAt":"2026-01-22T22:32:48.138Z","updatedAt":"2026-01-23T20:10:44.688Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"icscert"},"assigner":"icscert","products":["EVMAPA EVMAPA"],"affected":[{"vendor":"EVMAPA","product":"EVMAPA","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-08","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-022-08.json"],"weaknesses":["CWE-613"],"ingestedAt":"2026-10-29T20:09:31.862Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/55xxx/CVE-2025-55705.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-55705","state":"PUBLISHED","datePublished":"2026-01-22T22:32:48.138Z","dateUpdated":"2026-01-23T20:10:44.688Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2025-08-20T20:20:15.075Z"},"containers":{"cna":{"title":"EVMAPA Insufficient Session Expiration","descriptions":[{"lang":"en","value":"This vulnerability occurs when the system permits multiple simultaneous \nconnections to the backend using the same charging station ID. This can \nresult in unauthorized access, data inconsistency, or potential \nmanipulation of charging sessions. The lack of proper session management\n and expiration control allows attackers to exploit this weakness by \nreusing valid charging station IDs to establish multiple sessions \nconcurrently."}],"affected":[{"vendor":"EVMAPA","product":"EVMAPA","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-08"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-022-08.json"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-613","description":"CWE-613","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2026-01-22T22:32:48.138Z"},"credits":[{"lang":"en","type":"finder","value":"Khaled Sarieddine and Mohammad Ali Sayed reported these vulnerabilities to CISA"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"EVMAPA informed CISA they have resolved this issue and do not allow \nsimultaneous connection of charging stations with the same CBID.\n\n<br>"}],"value":"EVMAPA informed CISA they have resolved this issue and do not allow \nsimultaneous connection of charging stations with the same CBID."}],"source":{"advisory":"ICSA-26-022-08","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-23T20:10:35.019479Z","id":"CVE-2025-55705","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-23T20:10:44.688Z"}}]}}}