The WebSocket Application Programming Interface fails to restrict the number of authentication requests, allowing an attacker to perform brute‑force or denial‑of‑service attacks against the gateway. This lack of rate limiting can result in the suppression or diversion of legitimate charger telemetry or enable unauthorized access to the charging infrastructure. The flaw is a classic authentication‑brute‑force weakness, identified as CWE‑307.

CloudCharge’s CloudCharge.se product is affected. No specific version information is provided; any deployment of the WebSocket interface is vulnerable.

The CVSS score of 8.7 indicates a high severity vulnerability. An EPSS score of less than 1% suggests that exploitation has a low historical probability, and the flaw is not listed in CISA’s KEV catalog. The vulnerability can be exploited by any actor with network access to the WebSocket endpoint; no privileged access is required beyond the ability to send authentication attempts. The primary attack vector is remote over the public or private network connecting to the CloudCharge gateway.