A critical authentication rate-limiting vulnerability in the EV2GO ev2go.io platform exposes systems to unauthorized access and service disruption.

This vulnerability involves an improper restriction of excessive authentication attempts (CWE-307) within the WebSocket API. It permits an unauthenticated attacker to bypass standard rate limiting, facilitating brute-force credential attacks or the disruption of legitimate charger telemetry.

The lack of authentication request restrictions poses a severe risk to operational continuity and data integrity. A successful brute-force attack could lead to unauthorized administrative access, while the potential for denial of service threatens the availability of charger telemetry, which may result in significant operational downtime or loss of control over charging infrastructure. With a CVSS score of 7.5, this high-severity flaw necessitates immediate attention to prevent malicious exploitation.

Immediate Action: Monitor vendor communication channels and the official CISA advisory for the release of a security patch and apply it as soon as it becomes available.

Proactive Monitoring: Review system access logs for anomalous patterns of high-frequency authentication requests or repeated failed login attempts targeting the WebSocket interface.

Compensating Controls: Implement rate limiting at the network layer or via a Web Application Firewall (WAF) to throttle authentication requests directed toward the affected API endpoint until a vendor-supplied patch is deployed.

Public Exploit Available: No (exploit_available: false)

Given the exposure of the WebSocket API to unauthenticated attackers, the risk of unauthorized access is substantial. Administrators must prioritize the implementation of network-level rate limiting and maintain strict vigilance for security updates from the vendor. Applying the forthcoming patch immediately upon release is the only definitive method to eliminate this vulnerability.