IGL-Technologies eParking.fi Improper Restriction of Excessive Authentication Attempts
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.
IGL-Technologies has updated eParking's OCPP servers to reduce the risks posed by the vulnerability. These updates implemented the following security controls: 1-Enforce modern security profiles and stronger authentication. 2-Device level whitelisting was implemented to ensure authorized devices connect. 3-Rate limiting controls prevent excessive requests and reduces denial-of-service attacks. 4-Enhanced automated monitoring and alerting to detection abnormal network activity.
Devices using the encrypted deployment of eParking's OCPP servers or
IGL-Technologies proprietary eTolppa protocol are not impacted by these
vulnerabilities.
To prevent this in the future IGL-Technologies will continue
vulnerability monitoring under their ISO 27001:2022 security program and
tighten security requirements for future third‑party OCPP hardware
approvals.
For more information please contact the IGL-Technologies security team at this email address: security@igl.fi.
mailto:security@igl.fi
Configurations
Workarounds
Exploits
Credits
finder
Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA.