This weakness is classified as CWE-307: Improper Restriction of Excessive Authentication Attempts. The vulnerability lies in the WebSocket API used by Mobility46’s system, which lacks a limit on the number of authentication requests a client may send. Without rate limiting this weakness allows an attacker to flood the service with authentication attempts, potentially overwhelming the application and causing denial of service, as well as to brute‑force credentials to gain unauthorized access. The result is a compromise of confidentiality, integrity, or availability of charger telemetry data and related operations.

It affects the Mobility46:mobility46.se product, specifically its WebSocket authentication API. No version information is supplied, indicating that all current builds are potentially vulnerable.

The vulnerability is scored as high severity (CVSS 8.7) but has a very low exploitation probability (EPSS < 1%) and is not listed in the KEV catalog. The likely attack vector involves a remote attacker exploiting an open WebSocket endpoint from outside the network, repeatedly sending authentication messages to exhaust resources or guess credentials. The lack of commercial evidence of exploitation reduces the immediate risk, but the potential for a successful denial‑of‑service or unauthorized access event remains significant within affected environments.