Evoke CSMS CVE-2026-50176

The specific prerequisite is network reachability to the Evoke CSMS WebSocket authentication interface; per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no privileges, and no user interaction are required, so against an exposed endpoint this is remote and unauthenticated. The concrete enabling condition named in the description is the WebSocket API's complete absence of authentication-request rate limiting. Limiting factors: the attacker must have a network path to that endpoint (an internet-exposed CSMS is far more at risk than one segmented behind a VPN/firewall), the brute-force-to-access outcome additionally depends on weak or guessable credentials, and successful exploitation only directly yields availability impact (VA:H) unless credentials are actually cracked.

Signals are partially aligned but incomplete. The official CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.7 and characterizes the primary impact as availability only - consistent with a DoS reading - yet the description's 'brute-force to gain unauthorized access' implies a downstream confidentiality/integrity risk the vector does not credit; defenders should treat the access-compromise path as plausible but credential-strength-dependent. Exploitability factors are favorable to an attacker: network reachable, low complexity, no privileges, no user interaction. No EPSS score, no KEV listing, and no POC were provided, so real-world exploitation cannot be confirmed - this reads as a high-CVSS issue whose true priority hinges on whether the CSMS WebSocket endpoint is internet-exposed and whether account lockout exists elsewhere. Note the conflict: VA:H frames availability impact, while the brute-force language frames an access/auth impact - verify the intended consequence with the vendor or CISA advisory.

An attacker who can reach the Evoke CSMS WebSocket endpoint opens connections and submits authentication requests in a tight loop with no throttling to stop them. They either flood the endpoint until it exhausts resources and legitimate charge points can no longer connect (DoS), or they iterate through credential guesses at high speed to brute-force a valid account. No public exploit is identified at time of analysis, but the attack requires only basic scripting given the network vector and low complexity.