The vulnerability resides in the WebSocket API of Everon’s api.everon.io, which does not enforce any restriction on the number of authentication attempts. This flaw permits an attacker to flood the authentication endpoint, possibly causing denial of service by overwhelming legitimate telemetry traffic or, if credentials are guessed, gaining unauthorized access. The issue is classified under CWE‑307, an improper restriction of excessive authentication attempts.

The affected system is Everon’s api.everon.io platform. No specific product versions are listed, so all current deployments of the API service are potentially impacted until a fix is applied.

The high CVSS score of 8.7 reflects significant impact on availability and the risk of credential compromise. The EPSS score of less than 1% indicates that the likelihood of immediate exploitation in the wild is low, and the vulnerability is not currently listed in CISA’s KEV catalog. The most plausible attack path relies on sending repeated authentication requests over the WebSocket connection; an attacker would need network access to the vulnerable endpoint. Given the severity, the recommendation is to mitigate promptly, as the potential for denial of service or unauthorized access is serious.