The WebSocket backend of the Everon api.everon.io service links charging station identifiers to session IDs, but permits multiple connections with the same session identifier. Because the identifiers are predictable, an attacker can hijack or shadow a session, causing the newest connection to receive commands intended for the original station. This flaw also allows a malicious user to launch a denial‑of‑service attack by flooding the backend with valid session requests, as described in the advisory.

The vulnerability applies to all current deployments of Everon’s WebSocket backend for charging stations. No specific product versions are listed, so the issue is considered broadly applicable within the api.everon.io platform.

The CVSS v3.1 score of 6.9 indicates medium severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation at present. The flaw is not currently listed in CISA’s KEV catalog. Based on the description, the likely attack vector is network access to the WebSocket endpoint and knowledge of charging station identifiers. An attacker would need to send crafted WebSocket frames that reuse a valid session identifier, which could be performed remotely over the internet when the endpoint is exposed. Because Everon shut down the platform on December 1 2025, the active attack surface has been largely removed, but legacy or mis‑configured instances could still be vulnerable.