The Everon WebSocket backend contains a session handling vulnerability that allows unauthenticated attackers to hijack charging station sessions, posing a significant risk to operational integrity.

The application utilizes predictable session identifiers for WebSocket connections, failing to prevent multiple endpoints from using the same ID. This allows an unauthenticated attacker to displace a legitimate charging station and intercept backend commands.

Successful exploitation allows an attacker to intercept communications intended for legitimate charging stations, leading to unauthorized control of infrastructure or service disruption. Given the CVSS score of 7.3, this high-severity flaw threatens the availability and integrity of charging network operations, potentially resulting in widespread service outages.

Immediate Action: Contact the vendor immediately to obtain the necessary security updates or configuration changes to enforce unique session validation.

Proactive Monitoring: Review WebSocket connection logs for multiple concurrent connections using the same charging station identifier and monitor for unusual command sequences originating from unexpected sources.

Compensating Controls: Implement strict network-level access controls to restrict WebSocket traffic to known, authorized charging station IP ranges while awaiting vendor patches.

Public Exploit Available: Unknown

This vulnerability represents a critical risk to the availability and management of charging infrastructure. Administrators should prioritize the identification of all affected instances and coordinate with Everon to deploy remediations as soon as they become available to prevent potential session hijacking or denial of service attacks.