ePower epower.ie Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

过多认证尝试的限制不恰当

ePower 安全漏洞

ePower是爱尔兰ePower公司的一个电动汽车充电桩系统。 ePower存在安全漏洞，该漏洞源于缺少身份验证请求数量限制，可能导致拒绝服务攻击或暴力破解攻击。

N/A

N/A