Everon API CVE-2026-24696

Remote unauthenticated exploitation against the WebSocket authentication endpoint of api.everon.io requires no special configuration-the vulnerability exists in default API deployments accessible over standard HTTPS/WebSocket ports. Attackers need only network connectivity to the API service and basic WebSocket client capabilities to initiate authentication requests. Exploitation is NOT limited by: authentication requirements (PR:N in CVSS confirms no credentials needed to reach the vulnerable endpoint), user interaction (UI:N), or attack complexity (AC:L indicates straightforward exploitation). The impact is constrained to availability disruption of the API service itself and connected charging infrastructure, as the CVSS vector shows no confidentiality (VC:N) or integrity (VI:N) impact to the vulnerable system, though successful brute-force authentication bypass could lead to secondary confidentiality and integrity impacts on managed charging stations. Organizations face realistic risk only if they have deployed Everon's API service for managing operational charging infrastructure; test environments or disconnected systems are not vulnerable to remote attacks.

Real-world risk assessment using multiple signals reveals moderate-to-high concern despite low current exploitation indicators. The CVSS 4.0 score of 8.7 reflects high availability impact (VA:H) with network vector (AV:N), low complexity (AC:L), and no authentication required (PR:N), making this trivially exploitable by any internet-connected attacker. However, EPSS exploitation probability is only 0.06% (20th percentile), suggesting threat actors have not yet weaponized this weakness at scale. No CISA KEV listing exists as of this analysis, and no public proof-of-concept code is referenced. The SSVC framework would likely classify this as Scheduled remediation rather than immediate: while the technical impact is high (denial of service to critical infrastructure) and automatable (simple scripting can generate authentication floods), the lack of observed exploitation and the specificity of the target (EV charging operators using Everon) limits immediate urgency. The primary risk is operational: charging network operators face potential service disruptions affecting customer experience and revenue, plus the secondary risk of account compromise enabling manipulation of charging sessions, pricing, or energy management settings. The vulnerability's severity is amplified in contexts where Everon API manages large fleets or public charging networks versus small private installations.

An attacker identifies api.everon.io as the WebSocket endpoint managing a city's public EV charging network. Using a basic Python script with the websocket-client library, they open thousands of concurrent WebSocket connections and flood the authentication endpoint with randomized credential pairs at sustained rates exceeding 10,000 attempts per minute. The lack of rate limiting causes the API service to exhaust computational resources processing authentication requests, resulting in delayed or dropped telemetry updates from legitimate charging stations, preventing operators from monitoring station status, collecting payment data, or remotely managing sessions. Simultaneously, a credential-stuffing component of the attack cycles through leaked password databases against known operator email addresses, eventually gaining unauthorized access to an administrator account and manipulating charging session rates or disabling stations remotely.