The EV2GO ev2go.io platform’s WebSocket API does not limit the number of authentication attempts. This flaw allows attackers to flood the system, potentially disrupting charger telemetry or carrying out brute‑force credential guesses. The weakness is classified as CWE‑307, originating from the absence of rate limiting on the authentication endpoint.

Vendor: EV2GO. Product: ev2go.io. No specific version information is provided in the advisory. The affected configuration is represented by the generic CPE for the product.

The vulnerability scores 8.7 on the CVSS base scale, indicating high severity, while the EPSS estimate of less than 1% suggests a very low current likelihood of exploitation. It is not listed in the CISA KEV catalog. Attackers can exploit the issue remotely by repeatedly sending authentication requests over the WebSocket interface, either to overload the service and cause denial of service or to attempt credential brute‑forcing. The lack of any rate limiting mechanism makes these attack vectors straightforward to execute once the attacker can reach the WebSocket endpoint.