The ePower epower.ie WebSocket API lacks any restriction on the number of authentication requests it will accept. This deficiency enables an attacker to either flood the service with repeated authentication attempts, causing legitimate charger telemetry to be suppressed or mis‑routed, or to brute‑force credentials in pursuit of unauthorized access. The result is a loss of service availability for authorized users and a risk of compromising the charging infrastructure.

The vulnerability is confined to ePower’s epower.ie product. No specific affected versions are disclosed, so all installations of the ePower epower.ie platform that expose the WebSocket API are potentially susceptible.

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score is below 1 % and the issue is not listed in CISA’s KEV catalog, indicating that large‑scale exploitation is unlikely at present. However, the lack of rate limiting means that an attacker who can reach the WebSocket endpoint—most plausibly from the Internet via the car‑charger’s network interface—could launch a denial‑of‑service or brute‑force campaign. The impact on confidentiality, integrity, and availability is significant if the service is critical to charging operations.