EUVD-2026-39569
GHSA-v97x-26qp-3g45
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable WebSocket with no authentication gives AV:N/AC:L/PR:N/UI:N; impersonation exposes data and allows unauthorized actions (C:H/I:H) with limited availability impact (A:L), scope unchanged.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
5DescriptionCVE.org
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.
AnalysisAI
Authentication bypass in Evoke Systems' Evoke CSMS (EV Charging Station Management System) lets remote unauthenticated attackers connect to its WebSocket endpoints and impersonate legitimate charging stations. Because the OCPP-style WebSocket channel performs no authentication, an attacker can read sensitive station/session data and issue unauthorized commands, leading to privilege escalation and potential compromise of the broader charging backend. CVSS 4.0 rates this 9.3 (Critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is the subject of a CISA ICS advisory (ICSA-26-176-02).
Technical ContextAI
Evoke CSMS is a Charging Station Management System used to manage electric-vehicle supply equipment (EVSE), which typically communicate with the central management server over the Open Charge Point Protocol (OCPP) carried on WebSocket connections. The flaw maps to CWE-306 (Missing Authentication for Critical Function): the WebSocket endpoints that charging stations use to register and exchange messages do not verify the identity of the connecting peer, so any client that speaks the protocol can present itself as a station. The affected component is identified by CPE cpe:2.3:a:evoke:evoke_csms:*:*:*:*:*:*:*:* with no version boundaries published, indicating the weakness is in the application's connection-handling/authorization layer rather than a single library bug.
RemediationAI
No vendor-released patch version is identified in the available data, so confirm the fixed release directly with Evoke Systems (https://evokesystems.com/contact-us/) and review the CISA advisory ICSA-26-176-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-02) for vendor-supplied guidance before deployment. As compensating controls, restrict network reachability of the WebSocket/OCPP endpoints so only known charging-station source addresses can connect (firewall allow-listing or a dedicated VPN/management VLAN), which prevents arbitrary internet clients from impersonating stations at the cost of additional network configuration for each station. Where the deployment supports it, place the CSMS behind a reverse proxy or gateway that enforces mutual TLS (client certificates) or OCPP security profile 2/3 (TLS with basic-auth or client certs) on the station channel, accepting the operational overhead of certificate provisioning per station. Enable logging and monitoring of new station registrations and anomalous OCPP commands so impersonation attempts are detectable while a fix is pending.
More in Evoke Csms
View allDenial-of-service and credential brute-force exposure in Evoke Systems' Evoke CSMS (an EV charging station management sy
Evoke CSMS exposes charging station authentication identifiers through public web-based mapping platforms, allowing unau
Authentication bypass and denial-of-service in Evoke Systems' Evoke CSMS electric-vehicle charging station management sy
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today