EUVD-2026-39566
GHSA-79m4-gx9c-j55f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed CSMS WebSocket endpoint
-
DeliveryGuess valid charging-station session ID
-
ExploitReuse/duplicate predictable session identifier
-
ExecutionImpersonate station or flood backend
-
ImpactUnauthorized access or denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V7 - Session Management Session expiration enforcement
|
| Exploitation Conditions | Exploitation requires network reachability to the Evoke CSMS WebSocket/OCPP backend and knowledge or guessing of a valid charging-station identifier - which is feasible because the description states session identifiers are predictable and the backend permits multiple endpoints to connect with the same session identifier. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication or user interaction is needed and complexity is low. The principal limiting factor is exposure: if the CSMS endpoint is not internet-reachable (deployed behind VPN/mTLS/IP allow-listing) the attacker must first gain access to the charging network, and impersonation is bounded to stations whose identifiers can be discovered or guessed. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3 High) indicates a network-reachable, low-complexity, unauthenticated attack with low impact across confidentiality, integrity, and availability - consistent with session impersonation plus a DoS path. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation probability and automatability cannot be quantified from the input. Practically, the dual impact (impersonate another station/user OR overwhelm the backend) and the unauthenticated network vector make this a genuine priority for any operator running internet-exposed Evoke CSMS endpoints, but the modest per-incident impact (Low C/I/A - not full account takeover or RCE) tempers it below a critical emergency. One caveat: CWE-613 describes session expiration while the description emphasizes predictable/duplicate session identifiers - the underlying weakness is best read as broad session-management failure; confirm exact behavior with the vendor. |
| Exploit ScenarioDerived | An attacker enumerates or guesses a target charging station's identifier and opens a WebSocket connection to the internet-exposed Evoke CSMS, binding the same predictable session identifier to impersonate that station/user without credentials. Alternatively, the attacker scripts a flood of valid-looking session requests to exhaust backend resources and deny service to legitimate charge points. No public POC is identified, but the low attack complexity and absence of authentication make exploitation straightforward for a motivated actor. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 25, 2026
Authentication bypass and denial-of-service in Evoke Systems' Evoke CSMS electric-vehicle charging station management system stems from predictable WebSocket session identifiers derived from charging station IDs, with no enforcement against duplicate session reuse. Remote unauthenticated attackers can guess or reuse a session identifier to impersonate another charging station/user, or flood the backend with valid session requests to exhaust resources. Reported to CISA by ICS-CERT (advisory ICSA-26-176-02); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified in the available data; consult the CISA advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-02 and contact Evoke Systems directly via https://evokesystems.com/contact-us/ for an updated/fixed release and apply it once published. As compensating controls, do not expose the CSMS WebSocket endpoint directly to the internet - place it behind a TLS-terminating reverse proxy or VPN and restrict inbound connections to known charge-point source networks via firewall allow-listing (trade-off: requires inventory of legitimate station egress IPs and may complicate onboarding new chargers). Enforce mutual TLS (mTLS) client certificates per charge point so identity no longer relies on a guessable station ID (trade-off: certificate provisioning/rotation overhead). Add rate-limiting and connection caps on the WebSocket/OCPP listener to blunt the DoS flooding path (trade-off: aggressive limits may drop legitimate reconnect storms after outages), and monitor for duplicate concurrent sessions using the same station identifier as an indicator of impersonation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Evoke CSMS is a Charging Station Management System (CSMS) - the cloud/server backend that EV charge points connect to, typically over the OCPP protocol carried on WebSocket (ws/wss) connections. In OCPP, each charge point authenticates/associates itself using a ChargePoint/station identity string. Here the backend keys WebSocket sessions on that charging-station identifier and additionally permits multiple endpoints to bind the same session identifier concurrently. The root cause maps to CWE-613 (Insufficient Session Expiration / weak session management): because the identifier space is predictable (station IDs are guessable, not random secrets) and sessions are neither uniquely bound nor properly invalidated on reuse, session identity becomes forgeable. The single affected product is identified by CPE cpe:2.3:a:evoke:evoke_csms:*:*:*:*:*:*:*:* (all versions per available data).
Know when Evoke Csms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable WebSocket, no auth (PR:N) due to predictable guessable session IDs, low complexity; impersonation gives limited C/I and the flooding path gives limited A.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
Executive ViewAI
Evoke CSMS, a critical electric-vehicle charging management system, contains an unauthenticated authentication bypass vulnerability allowing attackers to impersonate legitimate charging stations and users, or launch denial-of-service attacks against the backend infrastructure. This exposes your charging network to operational disruption and unauthorized access with no vendor patch currently available, creating immediate risk to fleet operations and customer access.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation-restrict WebSocket endpoint access via firewall rules to authorized admin networks only; (2) Rate limiting-enforce strict connection throttles on session creation endpoints to prevent enumeration and resource exhaustion; (3) Monitoring-deploy anomaly detection on session reuse patterns and failed authentication attempts; (4) Access controls-require VPN or IP allowlisting for CSMS administrative access; (5) If operations-critical, temporarily restrict CSMS to read-only mode or offline procedures pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Evoke Csms
View allAuthentication bypass in Evoke Systems' Evoke CSMS (EV Charging Station Management System) lets remote unauthenticated a
Denial-of-service and credential brute-force exposure in Evoke Systems' Evoke CSMS (an EV charging station management sy
Evoke CSMS exposes charging station authentication identifiers through public web-based mapping platforms, allowing unau
Exploit-DB