CVE-2026-20882

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20882", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-02-24T00:30:38.944Z", "datePublished": "2026-03-06T15:05:42.589Z", "dateUpdated": "2026-03-10T17:59:37.339Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "e-mobi.hu", "vendor": "Mobiliti", "versions": [{"status": "affected", "version": "All versions", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA."}], "datePublic": "2026-03-04T05:18:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access."}], "value": "The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "description": "CWE-307", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-03-06T15:05:42.589Z"}, "references": [{"url": "https://mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalat"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-06"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-06.json"}], "source": {"advisory": "ICSA-26-062-06", "discovery": "EXTERNAL"}, "title": "Mobiliti e-mobi.hu Improper Restriction of Excessive Authentication Attempts", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Mobiliti did not respond to CISA's request for coordination. Contact Mobiliti using their contact page here: <a target=\"_blank\" rel=\"nofollow\" href=\"https://mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalat\">Https://mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalat</a> for more information."}], "value": "Mobiliti did not respond to CISA's request for coordination. Contact Mobiliti using their contact page here: https://mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalat for more information."}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-307", "lang": "en", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T17:48:36.752137Z", "id": "CVE-2026-20882", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:59:37.339Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20882", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T17:48:36.752137Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:48:45.802Z"}}], "cna": {"title": "Mobiliti e-mobi.hu Improper Restriction of Excessive Authentication Attempts", "source": {"advisory": "ICSA-26-062-06", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mobiliti", "product": "e-mobi.hu", "versions": [{"status": "affected", "version": "All versions", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-03-04T05:18:00.000Z", "references": [{"url": "https://mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalat"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-06"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-06.json"}], "workarounds": [{"lang": "en", "value": "Mobiliti did not respond to CISA's request for coordination. Contact Mobiliti using their contact page here: https://mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalat for more information.", "supportingMedia": [{"type": "text/html", "value": "Mobiliti did not respond to CISA's request for coordination. Contact Mobiliti using their contact page here: <a target=\"_blank\" rel=\"nofollow\" href=\"https://mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalat\">Https://mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalat</a> for more information.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.", "supportingMedia": [{"type": "text/html", "value": "The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-03-06T15:05:42.589Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20882", "state": "PUBLISHED", "dateUpdated": "2026-03-10T17:59:37.339Z", "dateReserved": "2026-02-24T00:30:38.944Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-03-06T15:05:42.589Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "e-mobi.hu", "vendor": "Mobiliti", "versions": [{"status": "affected", "version": "All versions", "versionType": "custom"}]}], "source": "ics-cert@hq.dhs.gov"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mvm:mobiliti_e-mobi.hu:-:*:*:*:*:*:*:*", "matchCriteriaId": "69A00306-0686-450C-B664-43615C81F236", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access."}, {"lang": "es", "value": "La interfaz de programaci\u00f3n de aplicaciones WebSocket carece de restricciones sobre el n\u00famero de solicitudes de autenticaci\u00f3n. Esta ausencia de limitaci\u00f3n de velocidad puede permitir a un atacante realizar ataques de denegaci\u00f3n de servicio suprimiendo o redirigiendo err\u00f3neamente la telemetr\u00eda leg\u00edtima del cargador, o realizar ataques de fuerza bruta para obtener acceso no autorizado."}], "id": "CVE-2026-20882", "lastModified": "2026-06-17T10:17:59.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20882", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T17:48:36.752137Z", "version": "2.0.3"}}]}, "published": "2026-03-06T16:16:09.913", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Product"], "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-062-06.json"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Product"], "url": "https://mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalat"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-06"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-307"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "e-mobi.hu", "source": "cna", "vendor": "Mobiliti"}, "product": "e-mobi.hu", "vendor": "mobiliti"}], "analysis": {"en": {"generated_at": "2026-04-16T11:23:22.940149+00:00", "value": {"mitigation_remediation": ["Contact Mobiliti via their support page (https://mobiliti.hu/emobilitas/ugyfeltamogatas/ugyfelszolgalat) to request a patch or further guidance.", "Deploy network\u2011level controls (e.g., firewall or IDS rules) that limit the rate of authentication requests per source IP to the WebSocket endpoint.", "Implement application\u2011level or reverse\u2011proxy rate limiting for authentication attempts to the WebSocket API to prevent excessive retries.", "Audit access logs for repeated failed authentication attempts and investigate any suspicious activity."], "summary": {"action": "Contact Vendor", "impact": "Denial of Service and Brute\u2011Force Attack"}, "threat_synthesis": {"affected_systems": "The affected product is Mobiliti e\u2011mobi.hu's WebSocket API used for charger telemetry. No specific firmware or version information is provided, so any deployment using the default WebSocket endpoint is potentially affected.", "description_and_impact": "The vulnerability arises from the WebSocket Application Programming Interface in Mobiliti e\u2011mobi.hu, which does not enforce any limits on the number of authentication attempts. Without a rate\u2011limiting mechanism, an attacker can overwhelm the system with repeated authentication requests, causing a denial of service by exhausting resources or mis\u2011directing legitimate charger telemetry. In addition, the absence of controls enables brute\u2011force attempts that could eventually grant unauthorized access to the authenticated API, compromising confidential telemetry data. The weakness is identified as CWE\u2011307, indicating inadequate restriction on authentication attempts.", "risk_and_exploitability": "The CVSS score of 8.7 classifies this flaw as a high severity vulnerability. The EPSS score is documented as less than 1\u202f%, indicating a very low current probability of exploitation, and the issue is not listed in the CISA KEV catalog. Potential attackers would need network access to the WebSocket endpoint and would exploit the lack of authentication throttling to perform DoS or brute\u2011force attacks. While the likelihood of a mass exploitation event is low, the high impact and absence of a public fix justify proactive mitigation."}}}}, "created": "2026-03-09T10:07:29.343311+00:00", "updated": "2026-04-16T11:30:15.904688+00:00", "vendors": ["mobiliti", "mobiliti$PRODUCT$e-mobi.hu"]}