Everon API CVE-2026-26288

Remote network access to Everon api.everon.io OCPP WebSocket endpoints is the primary requirement. Attacker must know or discover valid charging station identifiers, which may be predictable (sequential numbering, geographic patterns) or enumerable through brute-force connection attempts. No authentication credentials, user interaction, or privileged access required per CVSS vector PR:N/UI:N. Exploitation succeeds against default Everon API configurations lacking WebSocket authentication controls. Limiting factors include: network accessibility (endpoints may be firewalled to specific IP ranges in some deployments), knowledge of OCPP protocol message structure (requires technical familiarity with OCPP 1.6 or 2.0.1 specifications), and discovery of valid station identifiers (may require reconnaissance phase). Organizations using network segmentation or VPN-only access to charging infrastructure backends reduce but do not eliminate risk, as any network-accessible client within the permitted network can exploit this vulnerability.

Real-world risk is HIGH for operators of Everon charging infrastructure despite low EPSS score. CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable without authentication or user interaction against default configurations. The critical confidentiality and integrity impacts (VC:H/VI:H) reflect an attacker's ability to access charging session data and manipulate commands. However, EPSS percentile of 25% indicates exploitation requires domain-specific knowledge: attackers must understand OCPP protocol structure, identify exposed api.everon.io endpoints, and discover valid charging station identifiers. CISA ICS-CERT publication signals this affects operational technology in critical infrastructure (EV charging networks), elevating risk for energy sector organizations. No CISA KEV listing and low EPSS suggest targeted rather than widespread exploitation. The primary risk is to charging network operators using Everon's platform: competitors, activists, or financially motivated actors could disrupt charging services, manipulate billing data, or gain reconnaissance for physical infrastructure attacks. For organizations not using Everon systems, risk is zero. KEY UNCERTAINTY: CISA advisory does not confirm whether exploitation has occurred in operational environments, only that the vulnerability exists in deployed systems.

An attacker researches Everon charging network infrastructure and identifies api.everon.io WebSocket endpoints through DNS enumeration or public documentation. They connect using a WebSocket client to the OCPP endpoint and attempt connections with sequentially numbered or geographically predictable charging station identifiers until successful authentication bypass occurs. Once connected as a legitimate charger, the attacker issues StartTransaction commands to initiate fraudulent charging sessions, sends meter values with manipulated energy consumption data to inflate billing, or receives RemoteStartTransaction commands intended for real chargers to learn user behavior patterns. In a more sophisticated attack, they could send firmware update requests to redirect legitimate chargers to malicious endpoints or manipulate reservation data to deny service to legitimate EV drivers during peak demand periods.