Swtchenergy Com
Monthly
Missing WebSocket authentication — fourth CVE in the industrial platform WebSocket family. Same CWE-306 root cause enabling unauthenticated station impersonation.
Session hijacking in Swtchenergy.Com's WebSocket backend allows remote attackers to impersonate legitimate charging stations and intercept backend commands by exploiting predictable and non-unique session identifiers. An attacker can authenticate as other users, redirect charging station communications, or launch denial-of-service attacks by flooding the backend with valid session requests. No patch is currently available for this vulnerability.
Switchenergy.com's WebSocket API fails to implement rate limiting on authentication attempts, enabling attackers to launch denial-of-service attacks against the platform's charger telemetry infrastructure or execute brute-force credential attacks. This network-accessible vulnerability requires no authentication or user interaction, making it trivial to exploit and potentially exposing the service to sustained availability disruptions or account compromise.
Switchenergy.Com exposes charging station authentication credentials through publicly accessible web-based mapping platforms, allowing unauthenticated attackers to discover and potentially intercept sensitive authentication data. This vulnerability affects users and operators relying on the platform's mapping functionality and could enable unauthorized access to charging infrastructure. No patch is currently available to address this exposure.
Missing WebSocket authentication — fourth CVE in the industrial platform WebSocket family. Same CWE-306 root cause enabling unauthenticated station impersonation.
Session hijacking in Swtchenergy.Com's WebSocket backend allows remote attackers to impersonate legitimate charging stations and intercept backend commands by exploiting predictable and non-unique session identifiers. An attacker can authenticate as other users, redirect charging station communications, or launch denial-of-service attacks by flooding the backend with valid session requests. No patch is currently available for this vulnerability.
Switchenergy.com's WebSocket API fails to implement rate limiting on authentication attempts, enabling attackers to launch denial-of-service attacks against the platform's charger telemetry infrastructure or execute brute-force credential attacks. This network-accessible vulnerability requires no authentication or user interaction, making it trivial to exploit and potentially exposing the service to sustained availability disruptions or account compromise.
Switchenergy.Com exposes charging station authentication credentials through publicly accessible web-based mapping platforms, allowing unauthenticated attackers to discover and potentially intercept sensitive authentication data. This vulnerability affects users and operators relying on the platform's mapping functionality and could enable unauthorized access to charging infrastructure. No patch is currently available to address this exposure.