The vulnerability arises from charger authentication identifiers that are publicly accessible via web‑based mapping platforms. Compromise of these credentials can allow an attacker to spoof a legitimate charger, establish unauthorized sessions, and potentially disrupt charging operations. This represents an instance of CWE‑522, where insufficiently protected credentials facilitate impersonation attacks.

All deployments of EVoke’s EVoke CSMS are affected, particularly environments that still operate legacy chargers capable of only OCPP Security Profiles 0 or 1. The vulnerability applies regardless of the CSMS version, as the issue stems from the lack of secure credential handling rather than a specific code defect.

The CVSS score of 6.9 classifies the issue as medium severity, and the EPSS score is not available, indicating limited current exploitation data. Because the attack vector would rely on publicly discoverable identifiers, an adversary could perform connection attempts over the network to impersonate a charger. No public exploit is listed, and the vulnerability is not part of CISA’s KEV catalog. Nonetheless, the potential for spoofing and denial‑of‑service through repeated authentication attempts justifies monitoring and mitigation.