CVE-2025-55705

{"id": "CVE-2025-55705", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55705", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T20:10:35.019479Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ics-cert@hq.dhs.gov", "affectedData": [{"vendor": "EVMAPA", "product": "EVMAPA", "versions": [{"status": "affected", "version": "All versions"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-22T23:15:50.137", "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-022-08.json", "tags": ["Third Party Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-08", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability occurs when the system permits multiple simultaneous \nconnections to the backend using the same charging station ID. This can \nresult in unauthorized access, data inconsistency, or potential \nmanipulation of charging sessions. The lack of proper session management\n and expiration control allows attackers to exploit this weakness by \nreusing valid charging station IDs to establish multiple sessions \nconcurrently."}, {"lang": "es", "value": "Esta vulnerabilidad ocurre cuando el sistema permite m\u00faltiples conexiones simult\u00e1neas al backend utilizando el mismo ID de estaci\u00f3n de carga. Esto puede resultar en acceso no autorizado, inconsistencia de datos o manipulaci\u00f3n potencial de las sesiones de carga. La falta de una gesti\u00f3n de sesi\u00f3n y control de expiraci\u00f3n adecuados permite a los atacantes explotar esta debilidad reutilizando IDs v\u00e1lidos de estaciones de carga para establecer m\u00faltiples sesiones concurrentemente."}], "lastModified": "2026-06-17T09:42:05.733", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:evmapa:evmapa:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C85ACDB-38D2-4466-9206-529F45F4720E"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}