A critical authentication and availability vulnerability in Mobility46.se software allows unauthenticated attackers to perform brute-force attacks or disrupt device telemetry.

The application fails to implement rate limiting on the WebSocket authentication interface. This vulnerability permits an unauthenticated attacker to flood the service with authentication requests, leading to either unauthorized system access via brute-force or a denial-of-service by suppressing legitimate telemetry traffic.

The absence of authentication request restrictions poses a severe risk to operational continuity and data integrity. With a CVSS score of 7.5, this vulnerability could allow attackers to compromise charger management systems, resulting in unauthorized control or complete loss of visibility into critical infrastructure telemetry.

Immediate Action: Contact the vendor immediately to obtain specific security patches or configuration guidance to implement rate limiting on the WebSocket interface.

Proactive Monitoring: Review system access logs for anomalous spikes in connection requests or repeated failed authentication attempts originating from single IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an application-layer proxy to enforce rate limiting policies on WebSocket traffic until a vendor patch is applied.

Public Exploit Available: No confirmed public exploit available.

Given the potential for unauthorized access to industrial control infrastructure, this vulnerability requires urgent attention. Organizations should prioritize implementing network-level rate limiting or WAF rules to mitigate the risk while awaiting official vendor updates.