The vulnerability is a lack of proper authentication on WebSocket endpoints used by the EVoke CSMS platform, allowing an attacker to impersonate a charging station. An adversary can connect without credentials and issue any commands or retrieve sensitive data, effectively escalating privileges and potentially compromising the entire electric vehicle supply equipment management system. This flaw is identified as CWE-306, "Incorrect Authentication," illustrating the failure to enforce sufficient identity verification at the communication layer.

The affected product is EVoke Systems' EVoke CSMS platform, which supports WebSocket communication for charging stations. No specific version information is provided, implying that all current releases of EVoke CSMS that expose WebSocket endpoints without authentication are vulnerable. Users running EVoke CSMS, regardless of the underlying charger hardware, should assess whether their deployment uses the default unsecured WebSocket connections.

The CVSS score of 9.3 highlights a high severity, and although the EPSS score is not available, the lack of authentication gives adversaries an obvious attack path with low effort. The vulnerability is not listed in CISA’s KEV catalog, but the combination of high impact and straightforward exploitation makes it a priority for remediation. Attackers can simply open a WebSocket connection, spoof a charger identifier, and send authorized commands, leading to data theft or command injection. The EVoke-provided workaround recommends enforcing a single active connection per charger ID, rejecting unknown IDs from an allow-list, and implementing rate limiting at the gateway; these mitigations reduce but do not eliminate the risk until stronger TLS-based authentication (OCPP Security Profiles 2 or 3) is in place.