What is the CVSS score of CVE-2026-25113?

CVE-2026-25113 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Swtchenergy.Com are affected by CVE-2026-25113?

CVE-2026-25113 exposes our WebSocket authentication mechanism to brute-force attacks due to missing rate-limiting controls, potentially allowing attackers to compromise user accounts at scale.

How to fix or mitigate CVE-2026-25113?

Within 24 hours: Deploy Web Application Firewall (WAF) rules to rate-limit WebSocket authentication requests per IP and session. Within 7 days: Implement network segmentation to restrict WebSocket endpoints to trusted networks only and enable detailed logging of authentication attempts. Within 30 days: Coordinate with the vendor on patch availability, conduct full penetration testing of affected authentication systems, and review user account logs for unauthorized access attempts.

Swtchenergy.Com CVE-2026-25113

HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-02-27 ics-cert@hq.dhs.gov

Authentication Bypass Swtchenergy.Com

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.

AnalysisAI

Switchenergy.com's WebSocket API fails to implement rate limiting on authentication attempts, enabling attackers to launch denial-of-service attacks against the platform's charger telemetry infrastructure or execute brute-force credential attacks. This network-accessible vulnerability requires no authentication or user interaction, making it trivial to exploit and potentially exposing the service to sustained availability disruptions or account compromise.

Technical ContextAI

Classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts). Affects Swtchenergy.Com. The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.