CRITICAL CWE-306
CVE-2026-40702
EVoke Systems EVoke CSMS Missing Authentication for Critical Function
EVoke·CSMS
9.4/ 10
CVSS 3.1
Critical severity
0.65%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 52% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Jun 25, 2026
- Updated
- Jun 26, 2026
- First covered
- Jul 4, 2026
- Latest story
- 4 months ago
Summary
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityLow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LAffected products
- EVoke CSMSAll versions