The vulnerability stems from missing rate limiting on authentication requests within the WebSocket Application Programming Interface of the eParking.fi OCPP servers. Without restrictions, an attacker could flood the interface with authentication attempts, halting legitimate charger telemetry or overwhelming the server, or could attempt brute‑force authentication to gain unauthorized access. This flaw corresponds to improper restriction of authentication attempts (CWE‑307).

All IGL‑Technologies eParking.fi deployments that employ the standard unencrypted OCPP server interface or the proprietary eTolppa protocol are affected. Encrypted deployments of the eParking OCPP servers, or those using IGL‑Technologies’ proprietary eTolppa protocol, are explicitly stated as not impacted. No specific version numbers are provided in the advisory, but the CNA notes that a vendor update has been released to address the issue.

The CVSS base score of 8.7 indicates a high‑impact vulnerability, and the EPSS score is not available, so the current probability of exploitation is uncertain. The advisory states that the exploit can be carried out through network traffic to the WebSocket endpoint, implying a remote, network‑based attack vector. Because the weakness allows both denial‑of‑service and potential credential compromise, the overall risk to operators and users is significant if the affected OCPP servers remain unpatched.