CVE-2026-40702: EVoke Systems EVoke CSMS Missing Authentication for Critical Function

Synopsis

Missing authentication on WebSocket endpoints in EVoke Systems EVoke CSMS allows any network-accessible attacker to impersonate charging stations without credentials. The flaw is reachable over the network with no authentication required and no user interaction needed, as described by the CVSS v4.0 vector (AV:N/PR:N/UI:N). Successful exploitation gives the attacker full read and write access to sensitive system data and the ability to perform unauthorized actions across the charging management system, with the potential to escalate privileges and compromise the entire platform. HarborGuard is tracking the advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the EVoke CSMS WebSocket endpoints over the network; internet or internal network access to the service is sufficient.

• AuthenticationNot required

  No credentials or account of any kind are required; the WebSocket endpoints lack authentication entirely.

• Victim interactionNot required

  No user action or interaction is needed; the attacker can exploit the endpoint directly without involving any human victim.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup.

Blast Radius

• Attacker reads sensitive charging station data, session tokens, and operational records stored or transmitted through the CSMS.
• Attacker writes unauthorized commands or configuration changes to charging stations impersonating legitimate infrastructure.
• Attacker escalates privileges within the CSMS by acting as a trusted charging station identity, potentially gaining control over the broader system.
• Service availability is marginally degraded (CVSS VA:L), meaning partial disruption to charging session management is possible but full service crash is not indicated.