EV2GO WebSocket API Rate Limiting Vulnerability Allowing Denial-of-Service and Brute-Force Attacks

A vulnerability in the WebSocket API of EV2GO's charging management platform allows for the absence of rate limiting on authentication requests. This flaw could enable an attacker to launch denial-of-service attacks by disrupting or misdirecting legitimate charger telemetry, or to conduct brute-force attacks to gain unauthorized access.

Impact

Exploitation of this vulnerability could lead to denial-of-service conditions by misrouting or suppressing legitimate telemetry from charging stations, causing widespread disruption. Additionally, the lack of rate limiting could be exploited to perform brute-force attacks on authentication mechanisms, potentially leading to unauthorized access.

Remediation

EV2GO did not respond to CISA's request for coordination. Contact EV2GO through their contact page for more information.