What is the CVSS score of CVE-2026-25114?

CVE-2026-25114 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Cloudcharge.Se are affected by CVE-2026-25114?

CVE-2026-25114 is a high-severity vulnerability affecting WebSocket authentication that allows attackers to conduct brute-force attacks without rate limiting, potentially compromising user accounts…

How to fix or mitigate CVE-2026-25114?

Within 24 hours: Inventory all WebSocket APIs in production and assess internet exposure; enable logging for authentication failures. Within 7 days: Implement rate limiting at the WAF/load balancer level, deploy network segmentation to restrict WebSocket access to trusted networks only, and establish monitoring for suspicious authentication patterns. Within 30 days: Evaluate vendor patches and alternative solutions; conduct security assessment of compromised user accounts; deploy additional multi-factor authentication controls for critical systems.

Cloudcharge.Se CVE-2026-25114

HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-02-27 ics-cert@hq.dhs.gov

Authentication Bypass Cloudcharge.Se

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.

AnalysisAI

Cloudcharge.Se's WebSocket API fails to implement authentication rate limiting, enabling attackers to launch denial-of-service attacks against charger infrastructure or conduct brute-force credential attacks without restriction. The vulnerability affects remote, unauthenticated attackers and could result in service disruption or unauthorized system access. No patch is currently available.

Technical ContextAI

Classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts). Affects Cloudcharge.Se. The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.