The SWITCH Energy WebSocket API is vulnerable to authentication rate limiting flaws, posing a significant risk of service disruption and unauthorized access.

This vulnerability is a CWE-307 issue where the WebSocket API fails to implement restrictions on authentication requests. An unauthenticated attacker can leverage this to perform brute-force attacks or disrupt legitimate charger telemetry through denial-of-service conditions.

The lack of rate limiting allows for high-impact service degradation, specifically regarding critical infrastructure telemetry. With a CVSS score of 7.5, this vulnerability represents a high risk, potentially leading to unauthorized control of charging assets or total loss of system availability for affected energy management platforms.

Immediate Action: Since no specific patch version is currently available, contact SWITCH Energy support or monitor the official CISA ICS advisory for updates. Implement network-level rate limiting or throttling to restrict the volume of incoming WebSocket authentication requests.

Proactive Monitoring: Review system access logs for high-frequency authentication attempts originating from single IP addresses or abnormal patterns indicative of brute-force activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway capable of enforcing rate limiting and request validation for WebSocket traffic to mitigate the risk of automated abuse.

Public Exploit Available: Unknown.

Given the potential for unauthorized access to industrial control infrastructure, organizations using SWITCH Energy products must prioritize the implementation of network-level traffic shaping. While awaiting official vendor updates, treat this as a high-priority exposure and ensure that the API is not exposed to the public internet without robust authentication wrappers or proxy-based rate limiting.