What is the CVSS score of CVE-2026-25945?

CVE-2026-25945 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ev2go.Io are affected by CVE-2026-25945?

CVE-2026-25945 is a HIGH severity vulnerability affecting WebSocket authentication mechanisms that lack rate-limiting controls, potentially allowing attackers to conduct brute-force attacks against…

How to fix or mitigate CVE-2026-25945?

Within 24 hours: Inventory all applications and systems using WebSocket APIs and assess exposure; enable enhanced logging on authentication endpoints. Within 7 days: Implement rate-limiting and WAF rules to restrict authentication requests; consider temporarily disabling WebSocket functionality if business-critical. Within 30 days: Work with vendors for patch timelines; conduct security testing of any implemented compensating controls and evaluate alternative authentication mechanisms.

Ev2go.Io CVE-2026-25945

HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-02-27 ics-cert@hq.dhs.gov

Authentication Bypass Ev2go.Io

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.

AnalysisAI

Ev2go.Io's WebSocket API lacks authentication rate limiting, enabling attackers to launch denial-of-service attacks that disrupt charger telemetry or conduct brute-force attacks to compromise user accounts. The vulnerability affects all users of the platform and currently has no available patch. With a CVSS score of 7.5 and low exploit prevalence, this represents a significant availability and authentication risk requiring immediate mitigation.

Technical ContextAI

Classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts). Affects Ev2Go.Io. The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.