The vulnerability resides in the ev.energy WebSocket API, which lacks limits on authentication attempts. Attackers can flood the endpoint with credential requests, potentially overwhelming the device and disrupting charger telemetry, or attempt brute‑force credential guessing to gain unauthorized access. This weakness is a classic example of CWE‑307 and poses a high risk to both availability and confidentiality.

The affected product is ev.energy from EV Energy. No specific version or build information was disclosed in the advisory, so all releases of the platform that expose the WebSocket API are potentially impacted.

The CVSS score is 8.7, indicating a high severity vulnerability. The EPSS score of less than 1 % suggests that exploitation is currently unlikely but the low threshold means the risk could increase if a public exploit emerges. The vulnerability is not listed in the CISA KEV catalog, so there is currently no evidence of widespread exploitation. Attackers would target the WebSocket endpoint over the network, sending repeated authentication frames to trigger a denial of service or gain access.