The vulnerability arises from the WebSocket API of CTEK Chargeportal lacking any restriction on how many authentication attempts can be made. This omission permits an attacker to repeatedly send authentication requests, enabling either brute‑force credential discovery or the suppression of legitimate charger telemetry, resulting in a denial‑of‑service condition for the affected charging infrastructure. The weakness is classified as CWE‑307: Authentication Bypass Through Excessive Login Attempts.

The issue affects the CTEK Chargeportal product. No specific version information is supplied, so all installations of this product are potentially impacted until the service is sunset.

The CVSS score of 8.7 indicates a high severity, yet the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires network access to the WebSocket endpoint; no special authentication or privileged access is needed beyond the public interface. An attacker could simply flood the endpoint with login requests, causing service disruption or credential compromise for legitimate users. Because the product is slated for retirement, the long‑term risk to new deployments may be mitigated, but existing installations remain at high risk until appropriate controls are applied.