The Chargemap WebSocket API is vulnerable to brute-force and denial-of-service attacks due to a lack of rate limiting on authentication requests.

This vulnerability is a resource exhaustion and authentication bypass risk (CWE-307) caused by the absence of rate limiting on the WebSocket API, allowing unauthenticated attackers to conduct high-frequency requests.

The lack of authentication request restrictions poses a significant operational risk, as it enables attackers to disrupt critical charging telemetry services. Furthermore, the potential for brute-force attacks could lead to unauthorized account access, resulting in data exposure and potential manipulation of charger configurations, which carries a CVSS score of 7.5.

Immediate Action: Contact the vendor or monitor the official support page for the release of a security update that implements mandatory rate limiting on the WebSocket API.

Proactive Monitoring: Review system access logs for anomalous spikes in authentication requests or repeated failed login attempts directed at the WebSocket endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway to enforce request throttling and rate limiting on WebSocket connections to prevent brute-force attempts.

Public Exploit Available: No (exploit_available: false)

Given the potential for service disruption and unauthorized access, administrators must prioritize the implementation of rate limiting at the network or application edge. While official patches remain pending, strict monitoring of authentication traffic is essential to identify and block malicious activity originating from suspected brute-force sources.