The WebSocket API of the EVoke CSMS does not limit the number of authentication requests, allowing an attacker to repeatedly attempt credential verification. This flaw can be used to flood the service with connection attempts, exhausting resources and causing a denial-of-service, or to brute-force valid credentials, thereby gaining unauthorized access. Based on the description, the vulnerability can be exploited remotely via the WebSocket gateway, which is exposed to the network where EVSEs connect.

The affected product is the EVoke EVoke CSMS platform, particularly systems that interface with chargers running OCPP Security Profile 0 or 1. These legacy or unsupported chargers lack stronger security measures such as TLS or mutual authentication, leaving the CSMS susceptible to the described authentication flood. The issue applies to any installation that has not migrated to Security Profile 2 or 3 and has not implemented server‑side restrictions on charger identifiers.

The CVSS score of 8.7 signifies a high severity risk. The EPSS score is not available, so the current data does not indicate a measured probability of exploitation, but the lack of rate limiting inherently increases the opportunity for attackers to launch brute-force or denial‑of‑service attacks. The vulnerability is not listed in CISA’s KEV catalog, yet the combination of high severity and remote access potential warrants immediate attention.