EUVD-2026-39569
GHSA-v97x-26qp-3g45
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach CSMS WebSocket endpoint
-
DeliveryOpen unauthenticated WebSocket connection
-
ExploitImpersonate a charging station identity
-
ExecutionSend OCPP commands / read data
-
PersistEscalate privileges in backend
-
ImpactCompromise charging management system
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisite is network access to the Evoke CSMS WebSocket endpoint used by charging stations; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the description's statement that no authentication is required, exploitation works against default configurations without credentials or user interaction. The practical limiting factor is reachability: if the WebSocket/OCPP endpoint is exposed to the internet or a shared network, exploitation is trivial, whereas operators who already segment the station-management network behind a firewall, VPN, or mutual-TLS gateway substantially reduce exposure. No specific non-default feature toggle, platform, or version is named as required - the missing-authentication weakness appears inherent to the endpoint. |
| Impact | All available signals point to genuine high priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity attack needing no privileges or user interaction, with High confidentiality and integrity impact and Low availability impact (VC:H/VI:H/VA:L), yielding a Critical 9.3. The presence of a CISA ICS advisory (ICSA-26-176-02) reinforces that a coordinated-disclosure authority has validated the issue. Tempering this: there is no EPSS score, no POC, and no KEV entry provided, so active exploitation is not confirmed - the risk is currently driven by ease of exploitation and impact rather than observed attacks. No CVSS metrics conflict with the description; the only notable gap is the absence of affected version ranges and a fixed version, which complicates exposure scoping. Treat as a high-priority patch/mitigation item for any operator running Evoke CSMS with internet- or station-network-reachable WebSocket endpoints. |
| Exploit ScenarioDerived | An attacker who can reach the CSMS WebSocket endpoint over the network opens a connection and, because no credentials are checked, registers as an existing or arbitrary charging station identifier. They then issue OCPP messages to read transaction, meter, and configuration data and to send unauthorized control or configuration commands, pivoting toward privilege escalation across the management backend. No public exploit is identified at time of analysis, but the low complexity and absence of authentication make exploitation straightforward for anyone with protocol knowledge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 25, 2026
Authentication bypass in Evoke Systems' Evoke CSMS (EV Charging Station Management System) lets remote unauthenticated attackers connect to its WebSocket endpoints and impersonate legitimate charging stations. Because the OCPP-style WebSocket channel performs no authentication, an attacker can read sensitive station/session data and issue unauthorized commands, leading to privilege escalation and potential compromise of the broader charging backend. CVSS 4.0 rates this 9.3 (Critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is the subject of a CISA ICS advisory (ICSA-26-176-02).
Earlier versions of this analysis (2)
Authentication bypass in Evoke CSMS (Charging Station Management System) lets remote, unauthenticated attackers impersonate charging stations because the WebSocket endpoints used for station-to-server communication enforce no authentication. By spoofing a legitimate charger, an attacker can read sensitive operational data, issue unauthorized commands, and escalate privileges within the management platform. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the CVSS 4.0 base score of 9.3 (CRITICAL) reflects trivial network-based exploitation of default deployments.
Authentication bypass in Evoke Systems' Evoke CSMS (an EV charging station management platform) lets remote unauthenticated attackers impersonate charging stations because its WebSocket endpoints - typically the OCPP communication channel between chargers and the central system - enforce no authentication. Per the CVSS:3.1 vector (AV:N/PR:N), exploitation is fully unauthenticated over the network, scoring 9.4 (Critical) with high confidentiality and integrity impact. This was reported by CISA ICS-CERT (ICSA-26-176-02); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified in the available data, so confirm the fixed release directly with Evoke Systems (https://evokesystems.com/contact-us/) and review the CISA advisory ICSA-26-176-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-02) for vendor-supplied guidance before deployment. As compensating controls, restrict network reachability of the WebSocket/OCPP endpoints so only known charging-station source addresses can connect (firewall allow-listing or a dedicated VPN/management VLAN), which prevents arbitrary internet clients from impersonating stations at the cost of additional network configuration for each station. Where the deployment supports it, place the CSMS behind a reverse proxy or gateway that enforces mutual TLS (client certificates) or OCPP security profile 2/3 (TLS with basic-auth or client certs) on the station channel, accepting the operational overhead of certificate provisioning per station. Enable logging and monitoring of new station registrations and anomalous OCPP commands so impersonation attempts are detectable while a fix is pending.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Evoke CSMS is a Charging Station Management System used to manage electric-vehicle supply equipment (EVSE), which typically communicate with the central management server over the Open Charge Point Protocol (OCPP) carried on WebSocket connections. The flaw maps to CWE-306 (Missing Authentication for Critical Function): the WebSocket endpoints that charging stations use to register and exchange messages do not verify the identity of the connecting peer, so any client that speaks the protocol can present itself as a station. The affected component is identified by CPE cpe:2.3:a:evoke:evoke_csms:*:*:*:*:*:*:*:* with no version boundaries published, indicating the weakness is in the application's connection-handling/authorization layer rather than a single library bug.
Know when Evoke Csms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Network-reachable WebSocket with no authentication gives AV:N/AC:L/PR:N/UI:N; impersonation exposes data and allows unauthorized actions (C:H/I:H) with limited availability impact (A:L), scope unchanged.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.
Executive ViewAI
Evoke Systems' CSMS (EV Charging Station Management System) contains a critical authentication bypass in its WebSocket interface, allowing remote attackers without credentials to access charging station management infrastructure. Organizations operating this system face potential compromise of charging network operations, unauthorized station commands, and exposure of sensitive operational data. This affects EV charging network operators and their downstream backend systems.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict WebSocket endpoint access via firewall and require VPN/bastion host connections; (2) Deploy network-based intrusion detection signatures for anomalous CSMS authentication and station command patterns; (3) Implement real-time alerting on unauthorized privilege escalation attempts and out-of-policy station commands; (4) Segment CSMS infrastructure from external networks and isolate from critical backend systems; (5) Increase monitoring frequency and retention of charging station activity logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Evoke Csms
View allDenial-of-service and credential brute-force exposure in Evoke Systems' Evoke CSMS (an EV charging station management sy
Evoke CSMS exposes charging station authentication identifiers through public web-based mapping platforms, allowing unau
Authentication bypass and denial-of-service in Evoke Systems' Evoke CSMS electric-vehicle charging station management sy
Exploit-DB