WebSocket endpoints in the Everon api.everon.io platform lack authentication, allowing an attacker to impersonate a charging station. By connecting to the OCPP WebSocket endpoint with a known or easily discoverable station identifier, the attacker can issue or receive OCPP commands as if it were a legitimate charger. This flaw can result in unauthorized control of charging infrastructure, corruption of network data sent to the backend, and overall escalation of privileges for the attacker. The weakness is identified as CWE-306, Missing Authentication for a Critical Function.

The vulnerability targets the Everon:api.everon.io product line. Version information is not specified in the available data. The platform was shut down on December 1, 2025, removing the immediate risk, but any legacy installations that remain may still be susceptible if not updated or removed.

The CVSS score of 9.3 classifies the issue as a critical risk. The EPSS score is below 1%, suggesting that exploit attempts appear rare, though the flaw is present. It is not listed in the CISA KEV catalog, indicating no confirmed exploitation to date. An attacker could target the platform from anywhere that can reach the OCPP WebSocket endpoints, requiring only network access without authentication. The absence of authentication means that any such attacker can immediately elevate privileges and manipulate charging data.