A critical lack of rate limiting in the ev.energy WebSocket API exposes systems to potential unauthorized access via brute-force and service disruption.

The vulnerability is a lack of rate limiting (CWE-307) within the WebSocket API, which allows unauthenticated attackers to send an unlimited volume of authentication requests.

The absence of request restrictions presents a significant risk to operational integrity and account security. An attacker could successfully execute brute-force attacks to gain unauthorized access to user accounts or trigger a denial-of-service condition that suppresses critical charger telemetry. With a CVSS score of 7.5, this vulnerability is classified as High, reflecting the potential for significant disruption to service availability and account compromise.

Immediate Action: Contact the vendor immediately to obtain the latest security updates or configuration guidance, as no specific patch version is currently identified.

Proactive Monitoring: Review application access logs for high volumes of authentication requests or repeated failed login attempts originating from single sources.

Compensating Controls: Implement rate limiting at the network edge or via a Web Application Firewall (WAF) to restrict the frequency of incoming WebSocket authentication requests.

Public Exploit Available: Unknown

Organizations utilizing ev.energy should prioritize the implementation of external traffic filtering to mitigate the risk of brute-force and denial-of-service attacks. Given the lack of a documented patch, monitoring infrastructure and applying WAF-based rate limiting is essential to defend against this vulnerability until the vendor provides a permanent software fix.