PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-20882 Unknown Vendor CVE debrief

CVE-2026-20882 affects Mobiliti e-mobi.hu vers:all/* and is described by CISA as a WebSocket API issue with no restriction on the number of authentication requests. In practice, that creates two defensive concerns: an attacker may flood the authentication path to suppress or mis-route legitimate charger telemetry, or may repeatedly attempt logins to increase brute-force pressure against exposed access controls. CISA published the advisory on 2026-03-03 and rates the issue 7.5 HIGH.

Vendor
Unknown Vendor
Product
Mobiliti e-mobi.hu vers:all/*
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-03
Original CVE updated
2026-03-03
Advisory published
2026-03-03
Advisory updated
2026-03-03

Who should care

Operators and defenders responsible for Mobiliti e-mobi.hu deployments, especially teams managing charger telemetry, WebSocket-facing services, authentication controls, and OT/ICS network boundaries.

Technical summary

The advisory states that the WebSocket Application Programming Interface lacks rate limiting on authentication requests. The affected scope is listed as Mobiliti e-mobi.hu vers:all/*, with CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The reported impact is availability-focused, with a stated risk of denial-of-service against charger telemetry and brute-force attempts against authentication.

Defensive priority

High priority. Exposed WebSocket authentication endpoints should be throttled, access-restricted, and monitored quickly because the attack path is network-reachable, requires no privileges, and can directly affect service availability and telemetry integrity.

Recommended defensive actions

  • Add strict rate limiting and exponential backoff to WebSocket authentication requests.
  • Require network-level access controls for the WebSocket service, such as VPN, allowlisting, or segmented management networks.
  • Monitor authentication failures, request bursts, and gaps in charger telemetry for signs of abuse or service degradation.
  • Review whether stronger authentication controls, lockout thresholds, or secondary verification can be added without breaking operations.
  • Apply CISA ICS recommended practices and defense-in-depth guidance to the affected deployment.

Evidence notes

The supplied CISA CSAF advisory (ICSA-26-062-06) and CVE record identify the issue as insufficient restrictions on WebSocket authentication requests, with stated effects of denial-of-service and brute-force attempts. The advisory assigns CVSS v3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The source metadata also includes a SSVCv2 note of E:N/A:Y. The vendor attribution in the provided metadata is low-confidence and marked for review; the advisory itself names the product as Mobiliti e-mobi.hu vers:all/*.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-20882 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-20882

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-20882 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-20882

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-062-06.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-06

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.