Security readout for executives and security teams
Plain-English summary
CVE-2026-20895 affects EV2GO ev2go.io. The backend can accept multiple WebSocket connections using the same charging-station session identifier. An unauthorized party could impersonate or shadow a station connection, receive commands meant for it, or disrupt service. This is high priority for organizations relying on EV charging availability or command integrity.
Executive priority
Prioritize assessment this week if EV2GO supports active charging operations. The business risk is disruption or misdirection of charging station commands. If EV charging is safety-, revenue-, or fleet-critical, treat this as high urgency until vendor remediation or compensating controls are confirmed.
Technical view
The issue is insufficient session expiration/session uniqueness in the WebSocket backend. Charging station identifiers are used to associate sessions, but duplicate use is allowed. The newest connection can displace the legitimate station. CVSS is 7.3, network exploitable, low complexity, no privileges, no user interaction, with low confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most relevant where EV2GO ev2go.io backend services are reachable by charging stations or external networks. The source bundle lists EV2GO ev2go.io, all versions, as affected. Confirm whether your charging infrastructure, integrations, or managed service providers use this platform.
Exploitation context
CISA and CVE sources describe potential session hijacking, shadowing, unauthorized authentication, and denial of service through valid session requests. The bundle does not indicate public exploitation, and the CVE is not listed as KEV. Treat as plausible remote risk, not confirmed active exploitation.
Researcher notes
Evidence is limited to CVE and CISA advisory data. No patch, workaround, or exploit-in-the-wild claim is included in the provided sources. Avoid assuming broader EV2GO products are affected beyond ev2go.io. Focus validation on session uniqueness, duplicate station identifiers, and backend connection handling without weaponized testing.
Mitigation direction
- Check EV2GO and CISA guidance for vendor-approved updates or compensating controls.
- Restrict backend WebSocket access to trusted charging station networks where feasible.
- Monitor for duplicate station identifiers or unexpected reconnect patterns.
- Segment EV charging infrastructure from business-critical networks.
- Escalate to EV2GO support if no patched version is available.
Validation and detection
- Inventory systems using EV2GO ev2go.io or related EV2GO backend services.
- Confirm affected version status against CISA advisory and vendor documentation.
- Review logs for repeated connections sharing the same station identifier.
- Verify whether network controls limit backend access to authorized stations.
- Document operational impact if station command delivery is disrupted.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-613: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-20895 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L3.93.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://ev2go.io/CVE reference
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-04CVE reference
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-04.jsonCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficient Session Expiration
Insufficient Session Expiration represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.