CVE-2026-28230

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28230", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T15:28:40.651Z", "datePublished": "2026-02-26T22:49:33.613Z", "dateUpdated": "2026-02-27T18:17:19.675Z"}, "containers": {"cna": {"title": "In SteVe, any authenticated charger can terminate any other charger's active transaction (missing ownership verification on StopTransaction)", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/steve-community/steve/security/advisories/GHSA-6x38-4w7h-cwr8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/steve-community/steve/security/advisories/GHSA-6x38-4w7h-cwr8"}, {"name": "https://github.com/steve-community/steve/commit/7f169c6c5b36a9c458ec41ce8af581972e5c724e", "tags": ["x_refsource_MISC"], "url": "https://github.com/steve-community/steve/commit/7f169c6c5b36a9c458ec41ce8af581972e5c724e"}], "affected": [{"vendor": "steve-community", "product": "steve", "versions": [{"version": "<= 3.11.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:49:33.613Z"}, "descriptions": [{"lang": "en", "value": "SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransaction message, SteVe looks up the transaction solely by transactionId (a sequential integer starting from 1) without verifying that the requesting charger matches the charger that originally started the transaction. Any authenticated charger can terminate any other charger\u2019s active session across the entire network. The root cause is in OcppServerRepositoryImpl.getTransaction() which queries only by transactionId with no chargeBoxId ownership check. The validator checks that the transaction exists and is not already stopped but never verifies identity. As an attacker controlling a single registered charger I could enumerate sequential transaction IDs and send StopTransaction messages targeting active sessions on every other charger on the network simultaneously. Combined with FINDING-014 (unauthenticated SOAP endpoints), no registered charger is even required \u2014 the attack is executable with a single curl command requiring only a known chargeBoxId. Commit 7f169c6c5b36a9c458ec41ce8af581972e5c724e contains a fix for the issue."}], "source": {"advisory": "GHSA-6x38-4w7h-cwr8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T18:16:59.955068Z", "id": "CVE-2026-28230", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T18:17:19.675Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28230", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T18:16:59.955068Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T18:17:06.152Z"}}], "cna": {"title": "In SteVe, any authenticated charger can terminate any other charger's active transaction (missing ownership verification on StopTransaction)", "source": {"advisory": "GHSA-6x38-4w7h-cwr8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "steve-community", "product": "steve", "versions": [{"status": "affected", "version": "<= 3.11.0"}]}], "references": [{"url": "https://github.com/steve-community/steve/security/advisories/GHSA-6x38-4w7h-cwr8", "name": "https://github.com/steve-community/steve/security/advisories/GHSA-6x38-4w7h-cwr8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/steve-community/steve/commit/7f169c6c5b36a9c458ec41ce8af581972e5c724e", "name": "https://github.com/steve-community/steve/commit/7f169c6c5b36a9c458ec41ce8af581972e5c724e", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransaction message, SteVe looks up the transaction solely by transactionId (a sequential integer starting from 1) without verifying that the requesting charger matches the charger that originally started the transaction. Any authenticated charger can terminate any other charger\u2019s active session across the entire network. The root cause is in OcppServerRepositoryImpl.getTransaction() which queries only by transactionId with no chargeBoxId ownership check. The validator checks that the transaction exists and is not already stopped but never verifies identity. As an attacker controlling a single registered charger I could enumerate sequential transaction IDs and send StopTransaction messages targeting active sessions on every other charger on the network simultaneously. Combined with FINDING-014 (unauthenticated SOAP endpoints), no registered charger is even required \u2014 the attack is executable with a single curl command requiring only a known chargeBoxId. Commit 7f169c6c5b36a9c458ec41ce8af581972e5c724e contains a fix for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:49:33.613Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28230", "state": "PUBLISHED", "dateUpdated": "2026-02-27T18:17:19.675Z", "dateReserved": "2026-02-25T15:28:40.651Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T22:49:33.613Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "steve", "vendor": "steve-community", "versions": [{"status": "affected", "version": "<= 3.11.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:steve-community:steve:*:*:*:*:*:*:*:*", "matchCriteriaId": "9013F4F8-9CF8-4EEA-AB1F-444A22F863F5", "versionEndIncluding": "3.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransaction message, SteVe looks up the transaction solely by transactionId (a sequential integer starting from 1) without verifying that the requesting charger matches the charger that originally started the transaction. Any authenticated charger can terminate any other charger\u2019s active session across the entire network. The root cause is in OcppServerRepositoryImpl.getTransaction() which queries only by transactionId with no chargeBoxId ownership check. The validator checks that the transaction exists and is not already stopped but never verifies identity. As an attacker controlling a single registered charger I could enumerate sequential transaction IDs and send StopTransaction messages targeting active sessions on every other charger on the network simultaneously. Combined with FINDING-014 (unauthenticated SOAP endpoints), no registered charger is even required \u2014 the attack is executable with a single curl command requiring only a known chargeBoxId. Commit 7f169c6c5b36a9c458ec41ce8af581972e5c724e contains a fix for the issue."}, {"lang": "es", "value": "SteVe es un sistema de gesti\u00f3n de estaciones de carga de veh\u00edculos el\u00e9ctricos de c\u00f3digo abierto. En versiones hasta la 3.11.0 inclusive, cuando un cargador env\u00eda un mensaje StopTransaction, SteVe busca la transacci\u00f3n \u00fanicamente por transactionId (un entero secuencial que comienza en 1) sin verificar que el cargador solicitante coincida con el cargador que inici\u00f3 originalmente la transacci\u00f3n. Cualquier cargador autenticado puede terminar la sesi\u00f3n activa de cualquier otro cargador en toda la red. La causa ra\u00edz se encuentra en OcppServerRepositoryImpl.getTransaction() que consulta \u00fanicamente por transactionId sin una verificaci\u00f3n de propiedad de chargeBoxId. El validador verifica que la transacci\u00f3n existe y no est\u00e1 ya detenida, pero nunca verifica la identidad. Como un atacante que controla un \u00fanico cargador registrado, podr\u00eda enumerar IDs de transacci\u00f3n secuenciales y enviar mensajes StopTransaction dirigidos a sesiones activas en todos los dem\u00e1s cargadores de la red simult\u00e1neamente. Combinado con FINDING-014 (endpoints SOAP no autenticados), ni siquiera se requiere un cargador registrado; el ataque es ejecutable con un solo comando curl que requiere solo un chargeBoxId conocido. El commit 7f169c6c5b36a9c458ec41ce8af581972e5c724e contiene una soluci\u00f3n para el problema."}], "id": "CVE-2026-28230", "lastModified": "2026-06-17T10:28:22.487", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28230", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T18:16:59.955068Z", "version": "2.0.3"}}]}, "published": "2026-02-26T23:16:36.733", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/steve-community/steve/commit/7f169c6c5b36a9c458ec41ce8af581972e5c724e"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/steve-community/steve/security/advisories/GHSA-6x38-4w7h-cwr8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.11.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "steve", "source": "cna", "vendor": "steve-community"}, "product": "steve", "vendor": "steve-community"}], "analysis": {"en": {"generated_at": "2026-04-17T14:13:09.146983+00:00", "value": {"mitigation_remediation": ["Update SteVe to a version that includes the fix committed in 7f169c6c5b36a9c458ec41ce8af581972e5c724e or later.", "Disable the unauthenticated SOAP endpoints or enforce authentication to mitigate the secondary exposure that allows exploitation without credentials.", "Ensure that the StopTransaction method verifies that the requesting charger is the original transaction owner before committing the stop command."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized termination of charging transactions"}, "threat_synthesis": {"affected_systems": "The vulnerability affects steve-community\u2019s SteVe product, versions up to and including 3.11.0. Administrators running these releases should verify whether their deployment includes any of the affected builds.", "description_and_impact": "SteVe, an open-source EV charging station management system, contains a flaw in its authentication logic for the StopTransaction message (CWE\u2011284). The system verifies only the transaction ID and whether the transaction exists, without checking that the requesting charger is the one that initiated that transaction. Consequently, any authenticated charger\u2014 and, due to a separate exposure of unprotected SOAP endpoints, even an unauthenticated requester\u2014can stop any other charger's active session. This permits an attacker to disrupt charging, potentially causing financial loss or safety concerns, and represents an unauthorized control over a critical operational function.", "risk_and_exploitability": "The CVSS score of 5.7 indicates a moderate severity, but the EPSS score of less than 1\u202f% suggests a low likelihood of widespread exploitation at this time. Penetration of the vulnerability requires only knowledge of a chargeBoxId and the ability to issue a StopTransaction command; enumeration of sequential transaction IDs is trivial. Because the flaw can be exercised without prior authentication (provided FTP/ SOAP endpoints are not protected), the attack vector is effectively remote network access. The CNA notes that the issue is not present in the CISA KEV catalog, indicating it has not yet been widely exploited. Nonetheless, the potential to disrupt charging services warrants prompt remediation."}}}}, "created": "2026-02-27T09:03:47.757696+00:00", "updated": "2026-04-17T14:15:21.818561+00:00", "vendors": ["steve-community", "steve-community$PRODUCT$steve"]}