CVE-2026-24445

CVE-2026-24445 is a critical vulnerability affecting the ev.energy ev.energy platform, stemming from a lack of rate limiting in its WebSocket API for authentication requests. This flaw allows unauthenticated attackers to launch denial-of-service attacks by disrupting charger telemetry or conduct brute-force attacks to gain unauthorized access. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with low complexity, leading to high impacts on confidentiality, integrity, and availability. While there is no evidence of active exploitation (KEV: No) and no public exploit code (Metasploit, Nuclei, ExploitDB: None), the vulnerability has garnered significant community discussion, indicating awareness among security researchers.