# CVE-2026-44622: EVoke Systems EVoke CSMS credential exposure via mapping platforms

Source: https://junglewise.ai/threats/cve-2026-44622-evoke-systems-evoke-csms-credential-exposure-via-mapping  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-44622 · Severity: medium · CVSS 6.5 · Published 2026-06-25

EVoke Systems Charging Station Management System (CSMS) is used to manage and monitor electric vehicle charging infrastructure. A vulnerability exists where authentication identifiers for charging stations are publicly accessible through web-based mapping platforms. This exposure could allow unauthorized individuals to identify and potentially spoof charging stations, leading to unauthorized administrative control or disruption of charging services.

Technologies: [EVoke Systems CSMS](https://junglewise.ai/threats/technologies/csms). Vendors: [EVoke Systems](https://junglewise.ai/threats/vendors/evoke-systems).

## Quick answers

**Is CVE-2026-44622 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44622 being exploited in the wild.

**How severe is CVE-2026-44622?** Medium severity, with a CVSS score of 6.5, published 25 June 2026.

**Which products and versions are affected?** EVoke Systems CSMS All versions.

**Is there a fix for CVE-2026-44622?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44622 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-44622?** Check whether you run EVoke Systems CSMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The EVoke Systems Charging Station Management System (CSMS) suffers from a credential exposure vulnerability (CWE-522) where charging station authentication identifiers are accessible via public web-based mapping platforms. This vulnerability stems from the system's support for legacy OCPP security profiles (0 and 1) in certain hardware, which lack robust authentication. An unauthenticated remote attacker can harvest these identifiers to impersonate legitimate charging stations. Successful exploitation can lead to unauthorized administrative actions or denial-of-service by disrupting legitimate station connections. The vendor is working to migrate devices to OCPP Security Profiles 2 or 3 and implementing server-side allow-listing to mitigate risks for legacy hardware.

## Affected products

- EVoke Systems EVoke CSMS All versions

## Timeline

- 2026-06-25: disclosed
- 2026-06-25: advisory: CISA Advisory ICSA-26-176-02 published

## References

- [https://evokesystems.com/contact-us/](https://evokesystems.com/contact-us/)
- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-02.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-02.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-02)

## Related threats

- [EVoke Systems EVoke CSMS insufficient session expiration in WebSocket backend](https://junglewise.ai/threats/cve-2026-54479-evoke-systems-evoke-csms-insufficient-session-expiration-in)
- [EVoke Systems EVoke CSMS improper rate limiting in WebSocket API](https://junglewise.ai/threats/cve-2026-50176-evoke-systems-evoke-csms-improper-rate-limiting-in-websocket-api)
- [EVoke Systems EVoke CSMS missing authentication in WebSocket endpoints](https://junglewise.ai/threats/cve-2026-40702-evoke-systems-evoke-csms-missing-authentication-in-websocket)