Mobiliti E Mobi Hu
CVE-2026-20882
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to WebSocket API
-
ExploitSend unlimited authentication requests
-
ExecutionExhaust resources or brute-force credentials
-
ImpactDeny legitimate charger telemetry
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Brute-force prevention, rate limiting
|
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against WebSocket API lacking rate-limiting protections on authentication endpoints in default configurations. |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation no authentication required. |
| Exploit ScenarioDerived | An attacker without authentication could exploit this vulnerability to conduct denial-of-service attacks by suppressing or mis-routing legitimate charg. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Unrestricted authentication requests in the WebSocket API enable attackers to launch denial-of-service attacks against charger telemetry systems or execute brute-force attacks to gain unauthorized access. The vulnerability affects systems relying on this API without rate-limiting controls, and no patch is currently available. An unauthenticated remote attacker can exploit this over the network with minimal complexity to disrupt service availability or compromise system access.
Earlier versions of this analysis (1)
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. [CVSS 7.5 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-307: Improper Restriction of Excessive Authentication Attempts) The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.
Know when Mobiliti E Mobi Hu gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.
Executive ViewAI
CVE-2026-20882 exposes our WebSocket authentication mechanisms to brute-force and denial-of-service attacks due to unrestricted authentication requests, potentially compromising user accounts and application availability. This vulnerability affects any system or user leveraging WebSocket connections without rate-limiting protections, creating immediate risk to authentication integrity and service continuity.
Implement rate-limiting at the application or API gateway level to restrict authentication requests per IP/session; deploy Web Application Firewall (WAF) rules to throttle WebSocket authentication attempts (e.g., max 5 requests per 60 seconds); enable network segmentation to restrict WebSocket access to authorized networks only; implement robust logging and real-time alerting for authentication anomalies; consider temporarily disabling WebSocket functionality if not business-critical; enforce multi-factor authentication (MFA) to reduce brute-force impact; monitor for CVE-2026-20882 patch release from vendor.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB