EUVD-2026-39568
GHSA-5v82-xxfg-jqxw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated WebSocket flooding yields availability impact (A:H); confidentiality/integrity left N since access compromise is credential-dependent and not guaranteed.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
6DescriptionCVE.org
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.
AnalysisAI
Denial-of-service and credential brute-force exposure in Evoke Systems' Evoke CSMS (an EV charging station management system) stems from its WebSocket API enforcing no rate limit on authentication requests, letting a remote, network-positioned attacker flood the authentication endpoint to exhaust resources or rapidly guess credentials for unauthorized access. CISA's ICS-CERT (advisory ICSA-26-176-02) coordinated this issue, which carries a CVSS 4.0 base of 8.7 driven by high availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
Evoke CSMS is a Charging Station Management System used in EV-charging/OT environments; such platforms typically expose a WebSocket interface (commonly the OCPP transport) so charge points and operators can establish persistent sessions with the backend. The root cause is CWE-307 (Improper Restriction of Excessive Authentication Attempts): the WebSocket authentication handler accepts an unbounded number of attempts without throttling, lockout, or backoff. The single affected product is identified by CPE cpe:2.3:a:evoke:evoke_csms (all versions per the CPE wildcard). Because authentication can be retried at machine speed over the network, the same missing-control class enables both resource exhaustion (DoS) and online password/credential guessing (brute force).
RemediationAI
No vendor-released patch version is identified in the available data, so consult the CISA advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-02) and contact Evoke Systems (https://evokesystems.com/contact-us/) for fixed-version guidance and apply it once published. As compensating controls, place the CSMS WebSocket API behind a reverse proxy or WAF that enforces per-source connection and authentication-attempt rate limiting and temporary lockout (trade-off: aggressive thresholds may disrupt legitimate charge points that reconnect frequently); restrict network reachability of the WebSocket endpoint to known charge-point IP ranges via firewall/allowlist or VPN rather than leaving it internet-facing (trade-off: requires accurate inventory of charger source addresses); and enforce strong, unique credentials plus monitoring/alerting on repeated failed authentications to blunt the brute-force path (trade-off: detection-only, does not stop the DoS). Verify any version number against the vendor advisory before deploying.
More in Evoke Csms
View allAuthentication bypass in Evoke Systems' Evoke CSMS (EV Charging Station Management System) lets remote unauthenticated a
Evoke CSMS exposes charging station authentication identifiers through public web-based mapping platforms, allowing unau
Authentication bypass and denial-of-service in Evoke Systems' Evoke CSMS electric-vehicle charging station management sy
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today