The ePower WebSocket API is vulnerable to unauthenticated rate-limiting bypass, creating a significant risk of service disruption and unauthorized account access.

This vulnerability (CWE-307) involves an absence of rate limiting on the WebSocket authentication interface, which allows an unauthenticated attacker to perform high-volume authentication attempts.

Successful exploitation can lead to a denial-of-service condition where legitimate charger telemetry is suppressed or mis-routed, impacting operational availability. Furthermore, the lack of request restrictions facilitates brute-force attacks, potentially leading to unauthorized access to sensitive infrastructure management interfaces. With a CVSS score of 7.5, this high-severity flaw poses a direct threat to the integrity and availability of critical industrial control systems.

Immediate Action: Contact ePower support immediately to inquire about available firmware updates or specific configuration changes to enforce rate limiting on the WebSocket interface.

Proactive Monitoring: Review system access logs for spikes in authentication requests originating from single IP addresses or abnormal connection patterns to the WebSocket API.

Compensating Controls: Implement network-level rate limiting or a Web Application Firewall (WAF) to restrict the frequency of incoming requests to the API endpoints until an official patch is applied.

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub (KimJ6/PoC-Simulator_CVE-2026-27778).

Given the high severity of this vulnerability and the presence of a public proof-of-concept, administrators should treat this issue with high urgency. Prioritize the implementation of network-level rate limiting as a temporary measure while coordinating with the vendor to secure a permanent firmware update. Failure to restrict these authentication attempts leaves the system susceptible to both service outages and unauthorized administrative access.