CVE-2026-54479 EVoke Systems CVE debrief

Who should care

Organizations using EVoke Systems Charging Station Management System, particularly those in the industrial control systems (ICS) sector, should be aware of this vulnerability and take necessary actions to mitigate the risks.

Technical summary

The WebSocket backend of EVoke Systems Charging Station Management System uses charging station identifiers to associate sessions but allows multiple endpoints to connect using the same session identifier, resulting in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

Defensive priority

Organizations using EVoke Systems Charging Station Management System should prioritize patching and compensating controls due to the high CVSS score of 7.3 and potential for unauthorized authentication or denial-of-service attacks.

Recommended defensive actions

• Implement rate limiting at the WebSocket gateway layer to restrict excessive connection attempts
• Permit only a single active connection per charger ID and reject or terminate duplicate connections
• Monitor session anomalies, including repeated connection attempts and abnormal message patterns
• Prioritize upgrades to enable Security Profiles 2 or 3 for supported devices
• Implement additional server-side protections for legacy chargers, such as allow-listing registered charger IDs

Evidence notes

The source corpus provides details on the vulnerability in EVoke Systems Charging Station Management System, including predictable session identifiers due to the WebSocket backend's implementation. Evidence is based on CISA's CSAF advisory and related references.

Official resources