Which versions of Mobiliti E Mobi Hu are affected by CVE-2026-20882?

CVE-2026-20882 exposes our WebSocket authentication mechanisms to brute-force and denial-of-service attacks due to unrestricted authentication requests, potentially compromising user accounts and…

How to fix or mitigate CVE-2026-20882?

Within 24 hours: Identify and document all applications using WebSocket APIs in production; enable logging and alerting for authentication request anomalies. Within 7 days: Implement rate-limiting controls on WebSocket authentication endpoints and deploy WAF rules to restrict excessive authentication attempts; conduct account audit for suspicious login patterns. Within 30 days: Evaluate vendor patches or alternative WebSocket implementations with built-in request throttling; establish baseline metrics for normal authentication traffic and refine detection thresholds.

Mobiliti E Mobi Hu CVE-2026-20882

Q: What is the CVSS score of CVE-2026-20882?

CVE-2026-20882 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-03-06 ics-cert@hq.dhs.gov

Authentication Bypass Mobiliti E Mobi Hu

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 05, 2026 - 19:07 vuln.today

cvss_changed

CVSS changed

May 05, 2026 - 19:07 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.

AnalysisAI

Unrestricted authentication requests in the WebSocket API enable attackers to launch denial-of-service attacks against charger telemetry systems or execute brute-force attacks to gain unauthorized access. The vulnerability affects systems relying on this API without rate-limiting controls, and no patch is currently available. An unauthenticated remote attacker can exploit this over the network with minimal complexity to disrupt service availability or compromise system access.

Technical ContextAI

This vulnerability (CWE-307: Improper Restriction of Excessive Authentication Attempts) The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.