CVE-2026-27778

ePower epower.ie Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.

Affected

ePower · epower.ie

CVSS v4.0 HQ

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 HQ

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.81% chance of exploitation in the next 30 days, 56th percentile

Published

2026-03-05

Updated

2026-03-09

Proof-of-concept exploits (1)

• KimJ6/PoC-Simulator_CVE-2026-277780★ · 2026-05-04

Security advisories

• https://epower.ie/support
• cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-07.json

References

• CVE Record
• NVD entry