EV Energy WebSocket API Rate Limiting Vulnerability Allowing Denial-of-Service and Brute-Force Attacks

A vulnerability exists in the WebSocket API of EV Energy's charging management platform, allowing for an absence of rate limiting on authentication requests. This flaw could enable denial-of-service attacks by disrupting or misdirecting legitimate charger telemetry. Additionally, it could facilitate brute-force attacks to gain unauthorized access. The vulnerability affects all versions of EV Energy's platform.

Impact

Exploitation of this vulnerability could lead to unauthorized administrative control over affected charging stations or cause disruptions in charging services, similar to the impacts described in the advisory for CVE-2026-25774.

Remediation

EV Energy did not respond to CISA's request for coordination. Contact EV Energy using their contact page for more information.