EUVD-2026-39568
GHSA-5v82-xxfg-jqxw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated WebSocket flooding yields availability impact (A:H); confidentiality/integrity left N since access compromise is credential-dependent and not guaranteed.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.
AnalysisAI
Denial-of-service and credential brute-force exposure in Evoke Systems' Evoke CSMS (an EV charging station management system) stems from its WebSocket API enforcing no rate limit on authentication requests, letting a remote, network-positioned attacker flood the authentication endpoint to exhaust resources or rapidly guess credentials for unauthorized access. CISA's ICS-CERT (advisory ICSA-26-176-02) coordinated this issue, which carries a CVSS 4.0 base of 8.7 driven by high availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The specific prerequisite is network reachability to the Evoke CSMS WebSocket authentication interface; per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no privileges, and no user interaction are required, so against an exposed endpoint this is remote and unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are partially aligned but incomplete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the Evoke CSMS WebSocket endpoint opens connections and submits authentication requests in a tight loop with no throttling to stop them. They either flood the endpoint until it exhausts resources and legitimate charge points can no longer connect (DoS), or they iterate through credential guesses at high speed to brute-force a valid account. … |
| Remediation | No vendor-released patch version is identified in the available data, so consult the CISA advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-02) and contact Evoke Systems (https://evokesystems.com/contact-us/) for fixed-version guidance and apply it once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Evoke CSMS and confirm whether exposed to external networks; apply immediate network-level restrictions to block untrusted inbound access to the authentication endpoint. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Evoke Csms
View allAuthentication bypass in Evoke Systems' Evoke CSMS (EV Charging Station Management System) lets remote unauthenticated a
Evoke CSMS exposes charging station authentication identifiers through public web-based mapping platforms, allowing unau
Authentication bypass and denial-of-service in Evoke Systems' Evoke CSMS electric-vehicle charging station management sy
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today