SWITCH EV WebSocket API Rate Limiting Vulnerability Allowing Denial-of-Service and Brute-Force Attacks

A vulnerability exists in the WebSocket API of SWITCH EV's charging management platform, specifically in all versions of the web application. The issue arises from a lack of rate limiting on authentication requests, which could enable an attacker to launch denial-of-service attacks by disrupting legitimate charger telemetry or to conduct brute-force attacks to gain unauthorized access.

Impact

Exploitation of this vulnerability could lead to denial-of-service conditions by misrouting or suppressing legitimate charger data, allowing for unauthorized access through brute-force methods.

Remediation

SWITCH EV has not responded to CISA's request for coordination. For more information, contact SWITCH EV through their contact page.