CVE-2026-25945CWE-307
EV2GO ev2go.io Improper Restriction of Excessive Authentication Attempts
High · published February 26, 2026
What it is
The WebSocket Application Programming Interface lacks restrictions on
the number of authentication requests. This absence of rate limiting may
allow an attacker to conduct denial-of-service attacks by suppressing
or mis-routing legitimate charger telemetry, or conduct brute-force
attacks to gain unauthorized access.
The record
Technical detail
- CVSS v4.0
- 8.7 · HIGH
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.00953 · 61.0th percentile
- Weakness
- CWE-307 · Improper Restriction of Excessive Authentication Attempts
- Published
- 2026-02-26T23:46Z
EPSS history
Timeline