This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Mobiliti EV charging stations have a critical **Access Control Error**. ๐ **Consequences**: Attackers can impersonate sites, escalate privileges, and **unauthorizedly control** charging infrastructure.โฆ
๐ **Root Cause**: **CWE-306** (Missing Authentication for Critical Function). The **WebSocket endpoints** lack proper identity verification mechanisms. No gatekeeper = No security! ๐ช๐
Q3Who is affected? (Versions/Components)
๐ข **Affected**: **Mobiliti** (Hungarian company) e-mobi.hu EV charging systems. ๐ Specifically, the backend WebSocket communication channels used for station management.
Q4What can hackers do? (Privileges/Data)
๐ **Attacker Capabilities**: ๐ **Privilege Escalation**: Gain admin-like control. ๐ญ **Impersonation**: Fake site identity. ๐ **Control**: Manipulate charging stations without permission.โฆ
โก **Exploitation Threshold**: **LOW**. CVSS shows **AV:N** (Network), **AC:L** (Low Complexity), **PR:N** (No Privileges needed), **UI:N** (No User Interaction). Easy to exploit remotely! ๐ฏ
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ฆ **Public Exploit**: **No**. The `pocs` array is empty. While CISA issued an advisory, no specific Proof-of-Concept code or wild exploitation tools are currently public. ๐ต๏ธโโ๏ธ
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for **Mobiliti WebSocket endpoints**. Check if these endpoints require authentication tokens before accepting commands. Look for unauthenticated API calls in network traffic. ๐ก
Q8Is it fixed officially? (Patch/Mitigation)
๐ก๏ธ **Official Fix**: **Yes**. CISA Advisory **ICSA-26-062-06** was published on 2026-03-06. Vendors are urged to apply patches or mitigations immediately. ๐
Q9What if no patch? (Workaround)
๐ง **No Patch?**: Implement **Network Segmentation**. Block external access to WebSocket ports. Use **WAF rules** to filter unauthenticated WebSocket frames. Monitor logs for anomalous control commands. ๐งฑ
Q10Is it urgent? (Priority Suggestion)
๐ฅ **Urgency**: **CRITICAL**. CVSS Score implies High Impact. EV infrastructure is critical national infrastructure. Immediate patching or mitigation is required to prevent physical/digital disruption. โณ