Evoke CSMS CVE-2026-44622

Evoke CSMS must be integrated with one or more public web-based mapping platforms that surface authentication identifier fields in their externally accessible station data - this integration is the specific, concrete configuration condition driving the exposure. Deployments of Evoke CSMS that are not connected to any public-facing mapping service would not expose identifiers through this vector. Exploitation requires no authentication, no special tools, and no access to the CSMS itself - only access to the public mapping platform. What limits exploitation: the flaw is scoped to operators who have enabled public mapping integrations with Evoke CSMS; the exploitable impact is bounded by what those harvested identifiers can authorize within the EV charging ecosystem; and the attacker must know which mapping platform is receiving identifier data from the target deployment.

The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N reflects trivially accessible, unauthenticated exposure requiring no complexity or user interaction, while the S:U, C:L, and I:L components constrain the overall impact rating. No EPSS data was provided in the input, and this CVE is not listed in CISA KEV, meaning widespread or confirmed active exploitation is unconfirmed. No public exploit code has been identified. Despite the moderate CVSS score, the ICS-CERT reporting context elevates the real-world concern: EV charging infrastructure falls within energy critical infrastructure, and exposed authentication identifiers could enable fraudulent session authorization or charge point impersonation beyond simple data observation. The I:L component in the provided CVSS vector warrants explicit vendor clarification - if the identifiers are display-only artifacts that cannot be replayed or submitted to the CSMS, integrity impact may be overstated; if they can authenticate to the CSMS backend or to individual charge points, I:L is justified. This is a structural credential exposure issue rather than an imminent remote exploit scenario.

An attacker accesses a public web-based EV charging station mapping platform and queries or scrapes the station listing data for a target Evoke CSMS deployment, extracting exposed authentication identifiers without any authentication or special tooling. Using those harvested identifiers, the attacker could potentially submit them to the Evoke CSMS backend or individual charge points to authenticate as a trusted entity, enabling unauthorized charging session initiation or manipulation of authorization records. No exploit code has been publicly identified, and execution requires only internet access and knowledge of the mapping platform surfacing the data.