CVE-2026-24445 is a high severity (CVSS 7.5) flaw in the ev.energy charger WebSocket API, which does not limit authentication requests. CISA's advisory says the vendor did not respond to its coordination request and lists all versions as affected. Contact the vendor and apply compensating controls.
What's affected
CISA advisory ICSA-26-057-07 lists ev.energy, all versions, as known affected. It covers four CVEs, of which this is the rate limiting one. For the remediation, CISA states that ev.energy did not respond to its request for coordination and suggests contacting the vendor through its contact page.
The record says the missing limit may allow denial of service, by suppressing or mis-routing legitimate charger telemetry, or brute force attacks to gain unauthorized access.
How to check if you're exposed
If you operate or integrate with ev.energy services, ask the vendor in writing which of the four CVEs in the CISA advisory apply to your deployment and what the fix plan is.
On your side, look at the WebSocket endpoints your chargers connect to. Check whether your gateway or load balancer can count and limit authentication attempts per source, and review logs for repeated failed attempts or unusual connection volumes.
What to do now
- Contact ev.energy and ask for a fix timeline for the four CVEs in ICSA-26-057-07.
- Add rate limits and connection caps in front of the WebSocket endpoint where you control the path.
- Monitor for repeated authentication attempts and gaps in charger telemetry.
- Segment charger networks from other systems.
- Track the CISA advisory for revisions.
Why it matters
The weakness is CWE-307, improper restriction of excessive authentication attempts. An endpoint that accepts unlimited attempts lets automation try credentials or flood the service, and in a charging network that can mean lost telemetry as well as unauthorized access.
The CVSS vector rates only availability impact, as high. The same CISA advisory covers more serious issues, including missing authentication, so treat this as one piece of a bigger set. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is there a vendor fix?
CISA says ev.energy did not respond to its coordination request. Contact the vendor directly.
What does the flaw affect?
The advisory describes denial of service through suppressed or misrouted charger telemetry, and brute force attempts.
Sources
Last reviewed: 19 October 2026.
