CVE-2026-28230 is a medium-severity vulnerability affecting SteVe, an open-source EV charging station management system, in versions up to and including 3.11.0. This flaw allows any authenticated charger to terminate active charging sessions across the entire network by sending a StopTransaction message with a guessed transaction ID, without proper verification of the originating charger. The issue stems from the system's failure to check chargeBoxId ownership when processing StopTransaction requests. The vulnerability has a CVSS score of 6.3 (Medium) and an EPSS score of 0.0004. It can be exploited remotely with low attack complexity, potentially leading to denial of service, information disclosure, and integrity impacts (C:L/I:L/A:L). The attack can be executed even without a registered charger if combined with unauthenticated SOAP endpoints, requiring only a known chargeBoxId. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, indicating a low level of public attention. A fix for this vulnerability is available in commit 7f169c6c5b36a9c458ec41ce8af581972e5c724e.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.11.0CPE matchmatch criteria | cpe:2.3:a:steve-community:steve:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.