A critical lack of authentication rate limiting in the Everon WebSocket API exposes the system to brute-force attacks and service disruption.

This vulnerability is a result of missing rate limiting (CWE-307) on the WebSocket API. It allows an unauthenticated attacker to flood the interface with authentication requests, which facilitates both brute-force credential attacks and denial of service by disrupting legitimate charger telemetry.

The inability to restrict authentication attempts presents a significant risk to operational integrity and system security. A successful exploit could lead to the compromise of administrative or user accounts through brute force, or result in prolonged system downtime by overwhelming the API, which directly impacts the reliability of connected infrastructure. With a CVSS score of 7.5, the risk is high, particularly given the potential for remote, unauthenticated exploitation.

Immediate Action: Contact the vendor to obtain the latest security updates or configuration guidance to enable rate limiting on the WebSocket API.

Proactive Monitoring: Review system access logs for high volumes of authentication requests originating from single IP addresses or abnormal patterns indicative of automated brute-force attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or API gateway capable of enforcing request rate limits and throttling traffic to the affected WebSocket endpoint.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the exposure of the API to unauthenticated remote attackers and the potential for both account takeover and service degradation, this vulnerability must be treated with high priority. Organizations should immediately implement traffic shaping or rate-limiting controls at the network perimeter if vendor-provided patches are not yet available to mitigate the risk of automated exploitation.