CTEK Chargeportal WebSocket API Rate Limiting Vulnerability Allowing Denial-of-Service and Brute-Force Attacks

A vulnerability exists in the WebSocket API of CTEK Chargeportal, all versions, due to a lack of rate limiting on authentication requests. This flaw could enable attackers to perform denial-of-service attacks by disrupting or misdirecting legitimate charger telemetry, or to execute brute-force attacks to gain unauthorized access.

Impact

Exploitation of this vulnerability could lead to unauthorized administrative control over affected charging stations or cause disruptions in charging services, similar to a denial-of-service attack.

Remediation

CTEK will be discontinuing this product in April 2026. For more information, please contact CTEK support.