The WebSocket application programming interface exhibits a CWE‑307 (Improper Restriction of Excessive Authentication Attempts) by not enforcing any restrictions on the number of authentication attempts, which allows an attacker to abuse the authentication mechanism. This flaw can be leveraged to perform denial‑of‑service attacks by flooding the telemetry channel, or to conduct brute‑force attempts to gain unauthorized access, compromising the integrity of charger data and network security.

The vulnerability affects the WebSocket API of SWITCH EV's swtchenergy.com platform. Vendor SWITCH EV provides the product at swtchenergy.com, but no specific version or build information is disclosed in the advisory.

The CVSS score of 8.7 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of active exploitation at this time. The flaw is not listed in the KEV catalog. The likely attack vector is remote, over the network via WebSocket connections, requiring no privileged access. If exploited, an attacker could disrupt telemetry flows, cause service outages, or eventually elevate privileges through repeated authentication attempts.