CVE-2026-31903
published 2026-03-20CVE-2026-31903: The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.41%
32.6th percentile
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| igl-technologies | eparking.fi | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
IGL-Technologies eParking.fi
cisa_ics·2026-03-19·CVSS 9.4
[CRITICAL] IGL-Technologies eParking.fi
ICS Advisory
##
IGL-Technologies eParking.fi
Release DateMarch 19, 2026
Alert CodeICSA-26-078-07
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks.
The following versions of IGL-Technologies eParking.fi are affected:
- eParking.fi vers:all/*
CVSS
Vendor
Equipment
Vulnerabilities
| v3 9.4
| IGL-Technologies
| IGL-Technologies eParking.fi
| Missing Authentication for Critical Function, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration, Insufficiently P
GHSA
GHSA-6879-wrvx-7g25: The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests
ghsa_unreviewed·2026-03-21
CVE-2026-31903 [HIGH] CWE-307 GHSA-6879-wrvx-7g25: The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-03-20
Published