A critical authentication rate-limiting vulnerability in the CloudCharge WebSocket API exposes systems to brute force attacks and service disruption.

The vulnerability is an improper restriction of excessive authentication attempts (CWE-307) within the WebSocket API. It allows an unauthenticated attacker to perform unlimited authentication requests against the interface.

The absence of rate limiting creates a significant security risk, as attackers can perform brute force credential stuffing or flood the service to cause a denial of service. Given the CVSS score of 7.5, this high-severity flaw threatens the availability of charger telemetry and the integrity of user accounts. Successful exploitation could lead to unauthorized system access or the complete suspension of critical infrastructure monitoring capabilities.

Immediate Action: Contact CloudCharge support to obtain the latest security guidance and verify if a specific firmware or software update is available for your deployment.

Proactive Monitoring: Review authentication logs for patterns of rapid, repeated login attempts originating from single or distributed IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or API gateway capable of enforcing rate limits on WebSocket traffic to block excessive authentication attempts.

Public Exploit Available: Unknown

Organizations utilizing CloudCharge services must treat this vulnerability with high priority due to its potential impact on operational availability. Implement network-level rate limiting immediately while coordinating with the vendor to determine the availability of a permanent patch.