CVE-2026-25945
Published: 27 February 2026
Description
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized…
more
access.
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
This control directly enforces limits on consecutive invalid logon attempts and automatic response (e.g., lockout) to prevent brute-force exploitation of authentication mechanisms.
Specific conditions can include excessive failed attempts, triggering stronger authentication that restricts brute-force exploitation.
Security SummaryAI
CVE-2026-25945 is a vulnerability in the WebSocket Application Programming Interface that lacks restrictions on the number of authentication requests due to the absence of rate limiting. This issue, published on 2026-02-27, is associated with systems handling charger telemetry and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), mapped to CWE-307 (Improper Restriction of Excessive Authentication Attempts).
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry traffic, or facilitates brute-force attacks to achieve unauthorized access to the system.
CISA has issued Industrial Control Systems Advisory ICSA-26-057-04 addressing this vulnerability, with details available at https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-04 and in CSAF format at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-04.json; additional vendor information is at https://ev2go.io/.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Public-facing WebSocket API vuln enables exploitation (T1190); lack of auth rate limiting directly facilitates brute force (T1110) and application-layer DoS via request flooding (T1499).