Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-50176 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://evokesystems.com/contact-us/	[email protected]	Vendor
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-176-02.json	[email protected]	BundleRemedy
https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-02	[email protected]	AdvisoryBundleRemedy

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-307	Improper Restriction of Excessive Authentication Attempts	[email protected]

Affected Products

Product	Versions
EVoke Systems EVoke CSMS	<= 0
CPE No CPEs found in CPE dictionary for this product. Remediation Mitigation:low effort To reduce the risk of duplicate sessions, only a single active connection per charger ID will be permitted. If a second connection using the same charger ID is detected, the new connection will be rejected or the previous session will be terminated. Mitigation:low effort The platform will monitor session anomalies including repeated connection attempts, unexpected IP address changes, and abnormal message patterns. Security events will be logged and flagged for operational review. Mitigation:low effort To address the risk of denial-of-service via repeated authentication attempts, connection rate limiting will be implemented at the WebSocket gateway layer. These controls will restrict excessive connection attempts from the same source and temporarily block abusive traffic patterns. Mitigation:low effort EVoke is developing a lifecycle policy for legacy chargers that cannot support modern OCPP security profiles. This policy will include identification of unsupported EVSE models and risk classification Migration planning with site operators where possible. Workaround:low efforthttps://evokesystems.com/contact-us/ Contact EVoke for more information.

Product

Versions

EVoke Systems EVoke CSMS

<= 0

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Mitigation:low effort
To reduce the risk of duplicate sessions, only a single active connection per charger ID will be permitted. If a second connection using the same charger ID is detected, the new connection will be rejected or the previous session will be terminated.
Mitigation:low effort
The platform will monitor session anomalies including repeated connection attempts, unexpected IP address changes, and abnormal message patterns. Security events will be logged and flagged for operational review.
Mitigation:low effort
To address the risk of denial-of-service via repeated authentication attempts, connection rate limiting will be implemented at the WebSocket gateway layer. These controls will restrict excessive connection attempts from the same source and temporarily block abusive traffic patterns.
Mitigation:low effort
EVoke is developing a lifecycle policy for legacy chargers that cannot support modern OCPP security profiles. This policy will include identification of unsupported EVSE models and risk classification Migration planning with site operators where possible.
Workaround:low efforthttps://evokesystems.com/contact-us/
Contact EVoke for more information.

Change History

2 change records found show changes

Date	Action	Recorded By
Jun 26, 2026	CVE Modified	CISA-ADP
Jun 25, 2026	New CVE Received	[email protected]