eParking.fi EUVD-2026-13853

Requires network access to the eParking.fi WebSocket API endpoint, typically exposed on TCP port 443 (WSS) or 80 (WS). Exploitation succeeds against default configurations with no authentication throttling implemented (AC:L/PR:N confirms trivial access). Attack success depends on network accessibility - if API is internet-facing, any remote attacker can exploit; if restricted to internal charging network or VPN, attacker needs existing network foothold. No special product features or non-default settings required for exploitation. No user interaction needed (UI:N). Brute-force attack success rate depends on credential strength - default or weak passwords yield compromise within minutes, strong randomly-generated passwords may resist automated attacks. DoS attack succeeds regardless of credential strength, limited only by attacker's bandwidth and server capacity.

Real-world risk assessment requires reconciling conflicting signals across multiple frameworks. CVSS 8.7 indicates high severity driven by network attack vector (AV:N), zero authentication (PR:N), low complexity (AC:L), and high availability impact (VA:H). However, EPSS score of 0.07% (22nd percentile) suggests attackers currently show minimal interest, likely because eParking.fi has limited global deployment compared to mainstream EV charging platforms. SSVC framework marks exploitation status as 'none' (confirming no active attacks), 'automatable: yes' (credential stuffing and DoS scripts are trivial to deploy), and 'technical impact: partial' (aligns with availability-only impact in CVSS). Not present in CISA KEV database, confirming no confirmed active exploitation. The automatable nature significantly elevates risk beyond EPSS percentile - once discovered by opportunistic attackers or included in IoT botnet scanners, exploitation requires zero skill. Primary risk is operational disruption to EV charging infrastructure rather than data breach, but unauthorized access via brute-forced credentials could enable broader attacks including firmware manipulation, billing fraud, or using compromised chargers as network pivots. Critical missing data: no patch availability confirmed in provided references, no exploit code identified in public repositories, unclear if WebSocket endpoint is exposed to internet or restricted to management networks in typical deployments. Risk varies dramatically based on network architecture - internet-exposed APIs face immediate bot-driven brute-force risk, while VPN-protected deployments have substantially lower real-world exposure despite identical CVSS score.

Remote attacker identifies eParking.fi WebSocket endpoint via Shodan search for charging infrastructure APIs. Using automated brute-force tool, attacker submits 10,000 authentication attempts per minute using common credential lists (admin/admin, default charger passwords). Absence of rate limiting allows exhaustive enumeration until valid credentials discovered, granting access to charger management console. Alternatively, attacker launches DoS by opening thousands of WebSocket connections and flooding authentication requests, consuming server resources until legitimate charger telemetry fails to transmit, causing billing disruptions and preventing remote diagnostics. No public exploit code confirmed, but attack primitives (WebSocket flooding scripts, credential stuffing tools) are commodity offensive techniques.