A critical authentication rate-limiting flaw in the Mobiliti e-mobi.hu WebSocket API exposes systems to brute-force attacks and service disruption.

The vulnerability is a lack of rate limiting on the WebSocket API (CWE-307), which allows unauthenticated attackers to send an unlimited number of authentication requests to the service.

The absence of request restrictions presents a high risk to business operations, as it enables both denial-of-service attacks against charger telemetry and potential unauthorized access to user accounts. With a CVSS score of 7.5, this vulnerability represents a significant security gap that could lead to widespread service outages and the compromise of sensitive account credentials.

Immediate Action: Since no specific patch version is currently available, contact the vendor for guidance and restrict network access to the affected WebSocket interface where possible.

Proactive Monitoring: Monitor server access logs for anomalous spikes in authentication attempts originating from single or distributed IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway to enforce rate limiting on WebSocket connections and block suspicious traffic patterns.

Public Exploit Available: No

Given the lack of a formal patch, organizations must prioritize compensating controls to mitigate the risk of brute-force and denial-of-service attacks. IT teams should implement strict rate limiting at the perimeter and continuously monitor logs for signs of automated exploitation until a vendor-provided fix is deployed.