Is CVE-2026-54479 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54479 being exploited in the wild.

How severe is CVE-2026-54479?

High severity, with a CVSS score of 7.3, published 25 June 2026.

Which products and versions are affected?

EVoke Systems CSMS All versions.

Is there a fix for CVE-2026-54479?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-54479 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-54479?

Check whether you run EVoke Systems CSMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54479: EVoke Systems EVoke CSMS insufficient session expiration in WebSocket backend

CVE-2026-54479 · Severity: high · CVSS 7.3 · Published 2026-06-25

The EVoke Systems Charging Station Management System (CSMS) is used to manage electric vehicle charging infrastructure. A vulnerability in how the system handles connections allows multiple devices to use the same session identifier, which is based on predictable charging station IDs. This could allow an attacker to impersonate a charging station, gain unauthorized access to user sessions, or disrupt charging services by overwhelming the system with requests.

Technologies: EVoke Systems CSMS. Vendors: EVoke Systems.

Quick answers

Is CVE-2026-54479 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54479 being exploited in the wild.
How severe is CVE-2026-54479?: High severity, with a CVSS score of 7.3, published 25 June 2026.
Which products and versions are affected?: EVoke Systems CSMS All versions.
Is there a fix for CVE-2026-54479?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-54479 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-54479?: Check whether you run EVoke Systems CSMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WebSocket backend in EVoke CSMS uses charging station identifiers to uniquely associate sessions but fails to enforce single-connection limits per identifier. Because these identifiers are predictable, the implementation results in predictable session identifiers (CWE-613). A remote, unauthenticated attacker can exploit this by connecting to the backend using a known or guessed charger ID. This allows the attacker to either authenticate as another user/station or perform a denial-of-service attack by flooding the backend with valid session requests. The vendor is addressing this by implementing server-side protections, including allow-listing registered IDs and enforcing a single active connection per charger ID.

Affected products

EVoke Systems EVoke CSMS All versions

Timeline

2026-06-25: advisory: CISA and NVD published the advisory.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.