Which versions of Evoke CSMS are affected by CVE-2026-54479?

Evoke CSMS, a critical electric-vehicle charging management system, contains an unauthenticated authentication bypass vulnerability allowing attackers to impersonate legitimate charging stations and…

How to fix or mitigate CVE-2026-54479?

**Within 24 hours:** Inventory all Evoke CSMS deployments; isolate systems to restricted network segments; alert operations and security teams; enable enhanced WebSocket endpoint logging. **Within 7 days:** Implement rate limiting and intrusion detection rules targeting WebSocket session requests; deploy network access controls limiting CSMS access to trusted operators only; monitor for anomalous or duplicate session identifiers. **Within 30 days:** Contact Evoke Systems for patch timeline and interim guidance; evaluate network microsegmentation or temporary operational restrictions if patch timeline exceeds 60 days; establish incident response procedures specific to this vulnerability.

Evoke CSMS CVE-2026-54479

Q: What is the CVSS score of CVE-2026-54479?

CVE-2026-54479 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39566 MEDIUM

Insufficient Session Expiration (CWE-613)

2026-06-25 icscert

GHSA-79m4-gx9c-j55f

Authentication Bypass Evoke Csms Evoke

6.9

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

6.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable WebSocket, no auth (PR:N) due to predictable guessable session IDs, low complexity; impersonation gives limited C/I and the flooding path gives limited A.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 25, 2026 - 22:22 NVD

HIGH MEDIUM

CVSS changed

Jun 25, 2026 - 22:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Jun 25, 2026 - 21:52 vuln.today

DescriptionCVE.org

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

AnalysisAI

Authentication bypass and denial-of-service in Evoke Systems' Evoke CSMS electric-vehicle charging station management system stems from predictable WebSocket session identifiers derived from charging station IDs, with no enforcement against duplicate session reuse. Remote unauthenticated attackers can guess or reuse a session identifier to impersonate another charging station/user, or flood the backend with valid session requests to exhaust resources. Reported to CISA by ICS-CERT (advisory ICSA-26-176-02); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Evoke CSMS is a Charging Station Management System (CSMS) - the cloud/server backend that EV charge points connect to, typically over the OCPP protocol carried on WebSocket (ws/wss) connections. In OCPP, each charge point authenticates/associates itself using a ChargePoint/station identity string. Here the backend keys WebSocket sessions on that charging-station identifier and additionally permits multiple endpoints to bind the same session identifier concurrently. The root cause maps to CWE-613 (Insufficient Session Expiration / weak session management): because the identifier space is predictable (station IDs are guessable, not random secrets) and sessions are neither uniquely bound nor properly invalidated on reuse, session identity becomes forgeable. The single affected product is identified by CPE cpe:2.3:a:evoke:evoke_csms:*:*:*:*:*:*:*:* (all versions per available data).

RemediationAI

No vendor-released patch version is identified in the available data; consult the CISA advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-02 and contact Evoke Systems directly via https://evokesystems.com/contact-us/ for an updated/fixed release and apply it once published. As compensating controls, do not expose the CSMS WebSocket endpoint directly to the internet - place it behind a TLS-terminating reverse proxy or VPN and restrict inbound connections to known charge-point source networks via firewall allow-listing (trade-off: requires inventory of legitimate station egress IPs and may complicate onboarding new chargers). Enforce mutual TLS (mTLS) client certificates per charge point so identity no longer relies on a guessable station ID (trade-off: certificate provisioning/rotation overhead). Add rate-limiting and connection caps on the WebSocket/OCPP listener to blunt the DoS flooding path (trade-off: aggressive limits may drop legitimate reconnect storms after outages), and monitor for duplicate concurrent sessions using the same station identifier as an indicator of impersonation.