The vulnerability arises from the WebSocket Application Programming Interface in Mobiliti e‑mobi.hu, which does not enforce any limits on the number of authentication attempts. Without a rate‑limiting mechanism, an attacker can overwhelm the system with repeated authentication requests, causing a denial of service by exhausting resources or mis‑directing legitimate charger telemetry. In addition, the absence of controls enables brute‑force attempts that could eventually grant unauthorized access to the authenticated API, compromising confidential telemetry data. The weakness is identified as CWE‑307, indicating inadequate restriction on authentication attempts.

The affected product is Mobiliti e‑mobi.hu's WebSocket API used for charger telemetry. No specific firmware or version information is provided, so any deployment using the default WebSocket endpoint is potentially affected.

The CVSS score of 8.7 classifies this flaw as a high severity vulnerability. The EPSS score is documented as less than 1 %, indicating a very low current probability of exploitation, and the issue is not listed in the CISA KEV catalog. Potential attackers would need network access to the WebSocket endpoint and would exploit the lack of authentication throttling to perform DoS or brute‑force attacks. While the likelihood of a mass exploitation event is low, the high impact and absence of a public fix justify proactive mitigation.