Vulnerabilities

TI-2026-29379 CVE-2026-40702 · GHSA-v97x-26qp-3g45

EVoke Systems EVoke CSMS Missing Authentication for Critical Function

MEDIUM 49

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00646 Published 2026-06-25 No fix listed CWE-306

TI-2026-36936 CVE-2026-50176 · GHSA-5v82-xxfg-jqxw

EVoke Systems EVoke CSMS Improper Restriction of Excessive Authentication Attempts

MEDIUM 45

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00711 Published 2026-06-25 No fix listed CWE-307

TI-2026-39332 CVE-2026-54479 · GHSA-79m4-gx9c-j55f

EVoke Systems EVoke CSMS Insufficient Session Expiration

LOW 37

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0042 Published 2026-06-25 No fix listed CWE-613

TI-2026-32527 CVE-2026-44622 · GHSA-mr33-r399-w43m

EVoke Systems EVoke CSMS Insufficiently Protected Credentials

LOW 37

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00423 Published 2026-06-25 No fix listed CWE-522

Vulnerabilities

Filters

EVoke Systems EVoke CSMS Missing Authentication for Critical Function

EVoke Systems EVoke CSMS Improper Restriction of Excessive Authentication Attempts

EVoke Systems EVoke CSMS Insufficient Session Expiration

EVoke Systems EVoke CSMS Insufficiently Protected Credentials