Which versions of eParking.fi are affected by CVE-2026-31903?

CVE-2026-31903 affects eParking.fi's charging management platform, allowing unauthenticated attackers to conduct unlimited authentication attempts against the WebSocket API, resulting in…

How to fix or mitigate CVE-2026-31903?

Within 24 hours: Inventory all eParking.fi deployments and document current versions; implement network-level rate limiting on WebSocket API endpoints to restrict authentication attempts per source IP. Within 7 days: Deploy API gateway or WAF rules to enforce authentication attempt thresholds (recommend max 5 failed attempts per minute per IP); isolate eParking.fi management interfaces to internal networks only; enable comprehensive logging of authentication attempts. Within 30 days: Contact vendor for patch timeline; evaluate migration to alternative charging management platforms with stronger API authentication controls; conduct full security assessment of WebSocket API implementations.

eParking.fi CVE-2026-31903

Q: What is the CVSS score of CVE-2026-31903?

CVE-2026-31903 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-13853 HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-03-20 icscert

Authentication Bypass Eparking Fi Igl Technologies

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 06, 2026 - 18:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 06, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

May 06, 2026 - 18:22 NVD

7.5 (HIGH) 8.7 (HIGH)

EUVD ID Assigned

Mar 20, 2026 - 23:16 euvd

EUVD-2026-13853

Analysis Generated

Mar 20, 2026 - 23:16 vuln.today

CVE Published

Mar 20, 2026 - 22:56 nvd

HIGH 7.5

DescriptionCVE.org

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.

AnalysisAI

Unlimited authentication attempts against the eParking.fi WebSocket API enable network-based denial-of-service attacks that suppress or mis-route electric vehicle charger telemetry, and enable credential brute-forcing to gain unauthorized system access. Reported by ICS-CERT, affecting all versions of the charging management platform. EPSS score of 0.07% (22nd percentile) suggests low widespread exploitation probability, though SSVC marks it as automatable with partial technical impact. No active exploitation confirmed (not in CISA KEV), but CVSS 8.7 with AV:N/PR:N/AC:L indicates trivial remote exploitation against unauthenticated endpoints.

Technical ContextAI

This vulnerability affects the WebSocket API implementation in IGL Technologies' eParking.fi electric vehicle charging management platform (CPE: cpe:2.3:a:igl-technologies:eparking.fi). WebSocket protocols provide full-duplex communication channels over TCP, commonly used for real-time telemetry streaming from IoT devices like EV chargers. The root cause is CWE-307 (Improper Restriction of Excessive Authentication Attempts), meaning the API accepts unlimited login attempts without implementing throttling, account lockouts, CAPTCHA challenges, or exponential backoff. In industrial control systems like EV charging networks, WebSocket endpoints often handle critical operational data including charger status, energy metering, and fleet management commands. The absence of rate limiting on authentication creates two parallel attack surfaces: resource exhaustion through connection flooding (DoS) and systematic credential enumeration (brute-force). The CVSS 4.0 vector shows network accessibility (AV:N), low complexity (AC:L), no required privileges (PR:N), and high availability impact (VA:H), characteristic of unauthenticated API abuse vulnerabilities in operational technology environments.

RemediationAI

No vendor-released patch identified in CISA advisory or EUVD data at time of analysis. Until IGL Technologies releases fixed firmware, implement compensating controls: (1) Deploy network-layer rate limiting via WAF or reverse proxy - limit WebSocket authentication attempts to 5 per IP per 10 minutes (may disrupt legitimate retry behavior from chargers with intermittent connectivity). (2) Restrict WebSocket API access to known charger IP ranges using firewall ACLs or VPN tunnels - prevents internet-based attacks but requires static IP assignments or dynamic DNS for mobile charging infrastructure. (3) Implement application-layer account lockout after 5 failed attempts with 30-minute cooldown - risks operational impact if chargers use shared credentials. (4) Enable TLS client certificates for charger-to-server authentication - eliminates password brute-forcing entirely but requires certificate deployment to all field devices (high operational overhead). (5) Monitor authentication logs for volumetric anomalies (>10 failures/minute from single source) and implement automated IP blocking - reactive control only, may miss slow brute-force. Contact IGL Technologies support referencing ICSA-26-078-08 for patch timeline. Review CISA advisory for updated remediation guidance: https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08.