EUVD-2026-13855Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.
AnalysisAI
Missing rate limiting in CTEK Chargeportal's WebSocket API enables remote attackers to launch denial-of-service attacks against electric vehicle charging infrastructure telemetry or conduct brute-force authentication attacks. All versions of Chargeportal are affected. CISA ICS-CERT has issued an advisory (ICSA-26-078-06), indicating focus on critical infrastructure risk. EPSS exploitation probability is low (0.08%, 23rd percentile), and no active exploitation or public exploit is confirmed. SSVC assessment indicates the vulnerability is automatable but has no confirmed exploitation, suggesting moderate real-world urgency despite the high CVSS 8.7 score.
Technical ContextAI
This vulnerability affects CTEK's Chargeportal (CPE: cpe:2.3:a:ctek:chargeportal), a web-based platform for managing electric vehicle charging stations. The flaw exists in the WebSocket API implementation, which uses persistent bidirectional communication channels for real-time charger telemetry and control. CWE-307 (Improper Restriction of Excessive Authentication Attempts) identifies the root cause: the API accepts unlimited authentication requests without throttling, back-off mechanisms, or account lockout policies. WebSocket connections bypass traditional HTTP rate-limiting controls (which operate at request level), making application-layer rate limiting essential. The absence of such controls creates two attack surfaces: resource exhaustion through connection flooding (DoS) and credential enumeration through unlimited authentication attempts. The CVSS 4.0 vector (AV:N/AC:L/PR:N) confirms this is a remotely exploitable design flaw requiring no special privileges or complex setup.
RemediationAI
No vendor-released patch version is identified in available data at time of analysis. Operators should immediately contact CTEK support (https://www.ctek.com/support) for product-specific remediation guidance and monitor CISA advisory ICSA-26-078-06 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-06) for updates. Compensating controls to implement immediately: (1) Deploy reverse proxy or web application firewall with WebSocket-aware rate limiting (e.g., limit authentication attempts to 5 per IP per minute; may impact legitimate reconnection scenarios for unstable networks). (2) Restrict WebSocket endpoint access to trusted IP ranges using network ACLs or firewall rules (eliminates remote attack surface but requires static IP addressing for administrators). (3) Enforce strong password policies and enable multi-factor authentication if supported by Chargeportal (reduces brute-force attack success but does not prevent DoS). (4) Monitor authentication logs for patterns of repeated failures or connection floods (detection only; does not prevent exploitation). Note that rate limiting at reverse proxy level may interfere with legitimate high-frequency telemetry updates; test in non-production environment before deployment.
More in Chargeportal
View allCTEK Chargeportal's OCPP WebSocket endpoints accept unauthenticated connections, allowing remote attackers to impersonat
A session management vulnerability in CTEK ChargePortal's WebSocket backend allows attackers to hijack charging station
Authentication identifiers for electric vehicle charging stations are publicly exposed through web-based mapping platfor
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today