Mobility46 WebSocket API Rate Limiting Vulnerability Allowing Denial-of-Service and Brute-Force Attacks

A vulnerability exists in the WebSocket Application Programming Interface of Mobility46 charging station management software, all versions. The issue arises from a lack of rate limiting on authentication requests, which could enable an attacker to launch denial-of-service attacks by disrupting legitimate charger telemetry or to conduct brute-force attacks to gain unauthorized access.

Impact

Exploitation of this vulnerability could lead to unauthorized administrative control over affected charging stations or cause disruptions in charging services through denial-of-service attacks.

Remediation

Mobility46 has not responded to CISA's request for coordination. For more information, contact Mobility46 via their contact page.