CVE-2026-31903

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31903", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-03-12T20:17:17.765Z", "datePublished": "2026-03-20T22:56:27.047Z", "dateUpdated": "2026-03-23T15:56:29.649Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-03-20T23:02:55.988Z"}, "title": "IGL-Technologies eParking.fi Improper Restriction of Excessive Authentication Attempts", "datePublic": "2026-03-19T16:18:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-307", "description": "CWE-307", "type": "CWE"}]}], "affected": [{"vendor": "IGL-Technologies", "product": "eParking.fi", "versions": [{"status": "affected", "version": "All versions", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access."}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "IGL-Technologies has updated eParking's OCPP servers to reduce the risks posed by the vulnerability. These updates implemented the following security controls: 1-Enforce modern security profiles and stronger authentication. 2-Device level whitelisting was implemented to ensure authorized devices connect. 3-Rate limiting controls prevent excessive requests and reduces denial-of-service attacks. 4-Enhanced automated monitoring and alerting to detection abnormal network activity.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><div><span>IGL-Technologies has updated eParking's OCPP servers to reduce the risks posed by the vulnerability. These updates implemented the following security controls: 1-Enforce modern security profiles and stronger authentication. 2-Device level whitelisting was implemented to ensure authorized devices connect. 3-Rate limiting controls prevent excessive requests and reduces denial-of-service attacks. 4-Enhanced automated monitoring and alerting to detection abnormal network activity.</span></div></div>"}]}, {"lang": "en", "value": "Devices using the encrypted deployment of eParking's OCPP servers or \nIGL-Technologies proprietary eTolppa protocol are not impacted by these \nvulnerabilities.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Devices using the encrypted deployment of eParking's OCPP servers or \nIGL-Technologies proprietary eTolppa protocol are not impacted by these \nvulnerabilities."}]}, {"lang": "en", "value": "To prevent this in the future IGL-Technologies will continue \nvulnerability monitoring under their ISO\u202f27001:2022 security program and\n tighten security requirements for future third\u2011party OCPP hardware \napprovals.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "To prevent this in the future IGL-Technologies will continue \nvulnerability monitoring under their ISO\u202f27001:2022 security program and\n tighten security requirements for future third\u2011party OCPP hardware \napprovals."}]}, {"lang": "en", "value": "For more information please contact the IGL-Technologies security team at this email address: security@igl.fi.\n mailto:security@igl.fi", "supportingMedia": [{"type": "text/html", "base64": false, "value": "For more information please contact the IGL-Technologies security team at this email address: security@igl.fi.<br><a href=\"mailto:security@igl.fi\">mailto:security@igl.fi</a>"}]}], "credits": [{"lang": "en", "value": "Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA.", "type": "finder"}], "source": {"advisory": "ICSA-26-078-08", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-307", "lang": "en", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T14:51:32.470258Z", "id": "CVE-2026-31903", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:56:29.649Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31903", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T14:51:32.470258Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T14:51:44.518Z"}}], "cna": {"title": "IGL-Technologies eParking.fi Improper Restriction of Excessive Authentication Attempts", "source": {"advisory": "ICSA-26-078-08", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "IGL-Technologies", "product": "eParking.fi", "versions": [{"status": "affected", "version": "All versions", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "IGL-Technologies has updated eParking's OCPP servers to reduce the risks posed by the vulnerability. These updates implemented the following security controls: 1-Enforce modern security profiles and stronger authentication. 2-Device level whitelisting was implemented to ensure authorized devices connect. 3-Rate limiting controls prevent excessive requests and reduces denial-of-service attacks. 4-Enhanced automated monitoring and alerting to detection abnormal network activity.", "supportingMedia": [{"type": "text/html", "value": "<div><div><span>IGL-Technologies has updated eParking's OCPP servers to reduce the risks posed by the vulnerability. These updates implemented the following security controls: 1-Enforce modern security profiles and stronger authentication. 2-Device level whitelisting was implemented to ensure authorized devices connect. 3-Rate limiting controls prevent excessive requests and reduces denial-of-service attacks. 4-Enhanced automated monitoring and alerting to detection abnormal network activity.</span></div></div>", "base64": false}]}, {"lang": "en", "value": "Devices using the encrypted deployment of eParking's OCPP servers or \nIGL-Technologies proprietary eTolppa protocol are not impacted by these \nvulnerabilities.", "supportingMedia": [{"type": "text/html", "value": "Devices using the encrypted deployment of eParking's OCPP servers or \nIGL-Technologies proprietary eTolppa protocol are not impacted by these \nvulnerabilities.", "base64": false}]}, {"lang": "en", "value": "To prevent this in the future IGL-Technologies will continue \nvulnerability monitoring under their ISO\u202f27001:2022 security program and\n tighten security requirements for future third\u2011party OCPP hardware \napprovals.", "supportingMedia": [{"type": "text/html", "value": "To prevent this in the future IGL-Technologies will continue \nvulnerability monitoring under their ISO\u202f27001:2022 security program and\n tighten security requirements for future third\u2011party OCPP hardware \napprovals.", "base64": false}]}, {"lang": "en", "value": "For more information please contact the IGL-Technologies security team at this email address: security@igl.fi.\n mailto:security@igl.fi", "supportingMedia": [{"type": "text/html", "value": "For more information please contact the IGL-Technologies security team at this email address: security@igl.fi.<br><a href=\"mailto:security@igl.fi\">mailto:security@igl.fi</a>", "base64": false}]}], "datePublic": "2026-03-19T16:18:00.000Z", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.", "supportingMedia": [{"type": "text/html", "value": "The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-03-20T23:02:55.988Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31903", "state": "PUBLISHED", "dateUpdated": "2026-03-23T15:56:29.649Z", "dateReserved": "2026-03-12T20:17:17.765Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-03-20T22:56:27.047Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "eParking.fi", "vendor": "IGL-Technologies", "versions": [{"status": "affected", "version": "All versions", "versionType": "custom"}]}], "source": "ics-cert@hq.dhs.gov"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:igl:eparking.fi:-:*:*:*:*:*:*:*", "matchCriteriaId": "93828603-B375-4CEE-80BE-49966DC81197", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access."}, {"lang": "es", "value": "La Interfaz de Programaci\u00f3n de Aplicaciones WebSocket carece de restricciones sobre el n\u00famero de solicitudes de autenticaci\u00f3n. Esta ausencia de limitaci\u00f3n de velocidad puede permitir a un atacante realizar ataques de denegaci\u00f3n de servicio suprimiendo o redirigiendo err\u00f3neamente la telemetr\u00eda leg\u00edtima del cargador, o realizar ataques de fuerza bruta para obtener acceso no autorizado."}], "id": "CVE-2026-31903", "lastModified": "2026-06-17T10:34:43.723", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31903", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T14:51:32.470258Z", "version": "2.0.3"}}]}, "published": "2026-03-20T23:16:43.813", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Not Applicable"], "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Not Applicable"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-307"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "eParking.fi", "source": "cna", "vendor": "IGL-Technologies"}, "product": "eparking.fi", "vendor": "igl-technologies"}], "analysis": {"en": {"generated_at": "2026-03-21T07:03:36.203953+00:00", "value": {"mitigation_remediation": ["Install the IGL\u2011Technologies eParking OCPP server patch that enforces modern authentication profiles and rate limiting.", "Verify that the deployment uses the updated firmware and that device\u2011level whitelisting is active.", "If only the encrypted deployment or proprietary eTolppa protocol is in use, confirm those devices are not affected.", "Enable or review monitoring and alerting for abnormal authentication traffic on the WebSocket interface.", "If an update cannot be applied immediately, restrict network access to the OCPP endpoint and monitor for high\u2011rate authentication attempts.", "Contact IGL\u2011Technologies at security@igl.fi for further guidance."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service and Potential Unauthorized Access"}, "threat_synthesis": {"affected_systems": "All IGL\u2011Technologies eParking.fi deployments that employ the standard unencrypted OCPP server interface or the proprietary eTolppa protocol are affected. Encrypted deployments of the eParking OCPP servers, or those using IGL\u2011Technologies\u2019 proprietary eTolppa protocol, are explicitly stated as not impacted. No specific version numbers are provided in the advisory, but the CNA notes that a vendor update has been released to address the issue.", "description_and_impact": "The vulnerability stems from missing rate limiting on authentication requests within the WebSocket Application Programming Interface of the eParking.fi OCPP servers. Without restrictions, an attacker could flood the interface with authentication attempts, halting legitimate charger telemetry or overwhelming the server, or could attempt brute\u2011force authentication to gain unauthorized access. This flaw corresponds to improper restriction of authentication attempts (CWE\u2011307).", "risk_and_exploitability": "The CVSS base score of 8.7 indicates a high\u2011impact vulnerability, and the EPSS score is not available, so the current probability of exploitation is uncertain. The advisory states that the exploit can be carried out through network traffic to the WebSocket endpoint, implying a remote, network\u2011based attack vector. Because the weakness allows both denial\u2011of\u2011service and potential credential compromise, the overall risk to operators and users is significant if the affected OCPP servers remain unpatched."}}}}, "created": "2026-03-23T09:51:59.397347+00:00", "updated": "2026-03-25T14:33:59.049731+00:00", "vendors": ["igl-technologies", "igl-technologies$PRODUCT$eparking.fi"]}