Everon OCPP Backends WebSocket API Rate Limiting Vulnerability Allowing Denial-of-Service and Brute-Force Attacks

A vulnerability exists in the WebSocket API of Everon OCPP Backends, all versions, due to a lack of rate limiting on authentication requests. This flaw could enable an attacker to perform denial-of-service attacks by disrupting or misdirecting legitimate charger telemetry, or to conduct brute-force attacks to gain unauthorized access. Successful exploitation could lead to unauthorized administrative control over affected charging stations or cause disruptions in charging services.

Impact

Exploitation of this vulnerability could result in denial-of-service conditions by interfering with legitimate charger telemetry, or allow for unauthorized access through brute-force attacks, potentially leading to unauthorized administrative control over the charging stations.

Remediation

Everon has shut down their platform as of December 1, 2025.