PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24696 Unknown Vendor CVE debrief

CVE-2026-24696 is a WebSocket API rate-limiting weakness in Everon api.everon.io. According to CISA, the service lacks restrictions on authentication request volume, which can let an attacker overwhelm the backend, suppress or mis-route charger telemetry, or attempt brute-force authentication. The advisory’s remediation note also states Everon shut down the platform on 2025-12-01, which may reduce current exposure for any environments that no longer have the service reachable.

Vendor
Unknown Vendor
Product
Everon api.everon.io vers:all/*
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-03
Original CVE updated
2026-03-03
Advisory published
2026-03-03
Advisory updated
2026-03-03

Who should care

Operators of Everon api.everon.io backends, EV charging operators, and any teams integrating charger telemetry through the affected WebSocket API should review exposure. This is especially important where the backend remains reachable from untrusted networks or where authentication controls depend on upstream rate limiting.

Technical summary

CISA describes the issue as a lack of restrictions on the number of authentication requests to the WebSocket API. That maps to CWE-307 (improper restriction of excessive authentication attempts). The result is a network-reachable availability risk and possible unauthorized access attempts: attackers may flood authentication workflows to degrade service, interfere with telemetry handling, or brute-force credentials. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, rated 7.5 High.

Defensive priority

High for any still-exposed deployment; confirm whether any Everon endpoints remain reachable, because the advisory indicates the platform was shut down in 2025. If any legacy integrations persist, treat this as a service-availability and access-control issue requiring immediate validation and compensating controls.

Recommended defensive actions

  • Confirm whether any instance of api.everon.io or related Everon WebSocket endpoints are still reachable in your environment.
  • If any service remains exposed, add authentication throttling and request-rate controls at the application or fronting gateway layer.
  • Monitor for repeated authentication attempts, unusual WebSocket session churn, and charger telemetry suppression or mis-routing.
  • Review dependent EV charging integrations for failover or manual fallback paths in case backend access is degraded.
  • Remove or retire any remaining integrations if the vendor platform shutdown note reflects your deployment path.
  • Track the official CISA advisory and CVE record for any status updates or corrections.

Evidence notes

All technical claims here come from the supplied CISA CSAF source item and its metadata: the description states the WebSocket API lacks restrictions on authentication requests and cites denial-of-service and brute-force impact. The source metadata supplies the CVSS 3.1 vector and score, plus CWE-307 via the linked MITRE reference. The remediation entry states Everon shut down the platform on 2025-12-01. The advisory publication date used for timing context is 2026-03-03T06:00:00.000Z.

Official resources

CISA published the advisory and CVE record on 2026-03-03T06:00:00.000Z. The source remediation note says Everon shut down the platform on 2025-12-01, so current operational exposure depends on whether any legacy endpoints remain in service.