PT-2026-22220 · Steve · Steve

Bountyyfi · Published 2026-02-26 · Updated 2026-02-27 · CVE-2026-28230

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SteVe versions up to and including 3.11.0

Description SteVe is an open-source EV charging station management system susceptible to a transaction hijacking issue. An attacker controlling a registered charger, or even without registration leveraging unauthenticated SOAP endpoints, can terminate any other charger’s active session across the entire network. This occurs because the system identifies transactions by transactionId only, without verifying the requesting charger’s ownership. The issue resides in the OcppServerRepositoryImpl.getTransaction() function, which lacks a chargeBoxId ownership check. An attacker can enumerate sequential transactionId values and send StopTransaction messages to terminate active sessions on other chargers. The API endpoint used in the attack is the StopTransaction message. The vulnerable parameter is the transactionId.

Recommendations Update SteVe to a version after commit 7f169c6c5b36a9c458ec41ce8af581972e5c724e to address the issue.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-28230

GHSA-6X38-4W7H-CWR8

Affected Products

Steve

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28230.json · Exploit
• https://github.com/steve-community/steve/security/advisories/GHSA-6x38-4w7h-cwr8 · Vendor Advisory
• https://github.com/steve-community/steve/commit/7f169c6c5b36a9c458ec41ce8af581972e5c724e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28230 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28230 · Vendor Advisory
• https://twitter.com/CVEnew/status/2027466634638848447 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027193135315435778 · Twitter Post