Everon api.everon.io Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

关键功能的认证机制缺失

Everon 访问控制错误漏洞

Everon是Everon公司的一个电动汽车充电站系统。 Everon存在访问控制错误漏洞，该漏洞源于缺乏身份验证机制，可能导致未经验证的攻击者连接WebSocket端点并冒充合法充电站，从而引发权限提升、未经授权控制充电基础设施以及破坏充电网络数据。

N/A

N/A