WebSocket Vulnerability in Charging Station Solutions by Evoke Systems
CVE-2026-54479

6.9MEDIUM

Key Information:

Vendor

Evoke

Status
Evoke Csms
Vendor
CVE Published:
25 June 2026

What is CVE-2026-54479?

The WebSocket backend in charging station solutions by Evoke Systems is vulnerable due to the use of predictable session identifiers. This flaw allows multiple endpoints to connect using the same identifier, which could enable unauthorized users to impersonate legitimate users. Additionally, a malicious entity might exploit this vulnerability to overwhelm the backend by generating numerous valid session requests, potentially leading to service disruption.

Affected Version(s)

EVoke CSMS All versions

References

https://evokesystems.com/contact-us/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-1...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA.
.