EUVD-2026-39564
GHSA-mr33-r399-w43m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Public mapping platform exposure requires no privileges or interaction; direct integrity impact is not confirmed by description alone, so I:N is assessed pending vendor clarification.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
AnalysisAI
Evoke CSMS exposes charging station authentication identifiers through public web-based mapping platforms, allowing unauthenticated network actors to harvest credentials with no special access or interaction. Classified under CWE-522 (Insufficiently Protected Credentials) and reported by ICS-CERT via advisory ICSA-26-176-02, this flaw affects all tracked versions of the Evoke Charging Station Management System across its entire version history per the wildcard CPE. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the zero-prerequisite exposure in an OT/energy infrastructure context represents a meaningful credential leakage risk for affected operators.
Technical ContextAI
Evoke CSMS is a Charging Station Management System used to manage electric vehicle charging infrastructure, typically operating over the Open Charge Point Protocol (OCPP) or comparable protocols. Authentication identifiers in this context can include charge point IDs, RFID authorization tokens, or session keys used to validate and authorize EV charging sessions between the CSMS and individual charge points. CWE-522 (Insufficiently Protected Credentials) describes the root cause: these identifiers are surfaced through web-based mapping platforms that aggregate and publicly display EV charging station data, making them accessible to any internet user without authentication. The CPE string cpe:2.3:a:evoke:evoke_csms:*:*:*:*:*:*:*:* carries a full wildcard on version, indicating the issue is likely architectural - tied to how the CSMS integrates with external mapping services - rather than limited to a discrete code revision.
RemediationAI
No vendor-released patch version was identified in the available data. Operators should consult the CISA ICS advisory ICSA-26-176-02 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-02 and the CSAF file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-02.json for authoritative remediation guidance and any patch release. As immediate compensating controls, operators should audit which authentication identifier fields are shared with third-party mapping platform integrations and disable or restrict those integrations where possible - note this trade-off reduces station discoverability for end users. Any authentication identifiers confirmed to have been publicly exposed should be rotated or revoked where the CSMS and charge point hardware architecture permits, though this may require coordinated updates across deployed charging units. Outbound data-sharing configurations to mapping APIs should be reviewed and locked down to the minimum required fields. Contact Evoke Systems directly at https://evokesystems.com/contact-us/ to obtain patched software or additional vendor-specific mitigation guidance.
More in Evoke Csms
View allAuthentication bypass in Evoke Systems' Evoke CSMS (EV Charging Station Management System) lets remote unauthenticated a
Denial-of-service and credential brute-force exposure in Evoke Systems' Evoke CSMS (an EV charging station management sy
Authentication bypass and denial-of-service in Evoke Systems' Evoke CSMS electric-vehicle charging station management sy
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today