The vulnerability exists in the WebSocket API of Chargemap’s application, which does not enforce any limit on the number of authentication attempts. Because users can send unlimited authentication requests, an attacker can flood the service with requests, causing denial of service or diverting telemetry from legitimate chargers. Additionally, the absence of rate limiting allows brute‑force attempts to obtain valid credentials and potentially gain unauthorized access.

Chargemap’s Cargemap.com service. No specific version numbers are listed; the issue applies to the WebSocket endpoint used for charger telemetry and client authentication.

The CVSS score of 8.7 rates the vulnerability as high, while the EPSS score indicates a very low probability of exploitation in the near term. Because the attack can be carried out from any remote system that can reach the WebSocket endpoint, it is an external remote vulnerability. The lack of a CISA KEV listing suggests that no known active exploit is published; however, the potential to disrupt service or compromise credentials remains significant.