CVE-2026-25945 is a high severity flaw (CVSS 7.5) in the EV2GO charging platform, ev2go.io. Its WebSocket API does not limit authentication requests, which can enable denial of service or brute force. CISA lists no vendor fix, so use its network mitigations. The record does not list it in CISA's KEV catalog, and the sources we read do not report exploitation.
What's affected
- EV2GO ev2go.io, all versions per the CISA advisory
- No fixed version is listed
CISA states the vendor did not respond to its request for coordination. It reports no known public exploitation. The advisory covers several EV2GO issues, so read it in full.
How to check if you're exposed
If you operate or integrate with EV2GO, find out which of your charging stations and back office systems use its WebSocket API. Then check how that traffic reaches the internet, and whether you can see authentication attempts per station identifier in your logs.
Ask EV2GO for status through its website, as CISA advises.
What to do now
- Contact EV2GO through ev2go.io to ask about a fix or a timeline.
- Keep control system devices off the internet and reduce network exposure.
- Put control networks and remote devices behind firewalls, separated from business networks.
- Use a maintained VPN for remote access and secure the devices that connect to it.
- Add monitoring for bursts of failed authentication on the WebSocket endpoint and alert on them.
- Run an impact analysis and risk assessment before you change anything, as CISA advises.
Why it matters
CWE-307 is improper restriction of excessive authentication attempts. Without a limit, an attacker can guess identifiers or secrets as fast as the service answers. A flood of attempts can also tie up the service so legitimate chargers cannot report in, which is the denial of service and mis-routing risk the record describes.
Charging networks use identifiers and sessions to decide which station is talking. If authentication can be hammered, the telemetry behind billing and control becomes less trustworthy. Rate limiting, backoff and lockout are low cost controls that belong at the edge of every authentication endpoint.
Because no fix is listed, the practical risk lives in how the endpoint is exposed. Network layer controls are the thing you can change today.
Quick check
Is there a patch?
CISA lists none and says the vendor did not respond to its coordination request. Ask EV2GO directly.
What does CISA recommend meanwhile?
Keep devices off the internet, use firewalls and segmentation, and use updated VPNs for remote access.
Sources
Last reviewed: 19 October 2026.
