CVE-2026-25113 is a high severity flaw (CVSS 7.5) in the SWTCH Energy charging platform. The WebSocket API places no limit on authentication requests, which can allow denial of service or brute force attempts to gain access. SWTCH has applied configuration changes, and CISA's advisory lists compensating controls rather than a patch version.
What's affected
- Affected: SWTCH EV swtchenergy.com, all versions, per CISA advisory ICSA-26-057-06.
- Fixed in: no version number. The advisory describes vendor side mitigations.
The CISA advisory says SWTCH applied configuration changes that enforce security checks on initial connections from untrusted chargers. It adds that for some chargers already in the field, full enforcement depends on device constraints such as legacy firmware and SSL/TLS compatibility. SWTCH applies compensating controls, including monitoring and network level restrictions such as IP based access controls, while upgrades or retirements are completed.
How to check if you're exposed
If you use SWTCH to manage chargers, ask SWTCH which of your chargers are covered by the updated policy and which still depend on compensating controls. Review your own network paths too. Check whether charger traffic reaches the platform through addresses you can restrict.
What to do now
- Contact SWTCH Energy and ask which chargers you own are fully covered.
- Upgrade or retire older chargers when the vendor says they can be brought in line.
- Where you control the network, allow connections only from known charger sources.
- Watch for bursts of failed authentication attempts and for chargers that go quiet.
Why it matters
Without a cap on attempts, an attacker can keep guessing or flood the endpoint. Two outcomes follow from the description: legitimate charger telemetry can be suppressed or misrouted, and weak credentials can be brute forced. The weakness is CWE-307 (Improper Restriction of Excessive Authentication Attempts).
The fix for a rate limit is simple in principle, but it has to work with devices that cannot be updated easily. That is why the vendor leans on network controls. If you run chargers, keep a list of firmware versions, so you can tell which ones depend on that safety net.
Quick check
Is there a patched version number?
No version is given. CISA describes configuration changes, upgrades where supported and compensating controls.
Is it exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the advisory does not report exploitation.
Sources
Last reviewed: 19 October 2026.
