EVoke Systems Charging Station Management System

The EVoke Systems Charging Station Management System suffers from four critical vulnerabilities rooted in fundamental authentication and session management failures: missing WebSocket authentication, no rate limiting on login attempts, weak session expiration with predictable session identifiers, and publicly exposed charging station credentials. These flaws collectively allow attackers to bypass access controls entirely, brute-force credentials unchallenged, hijack active sessions, or harvest credentials directly from the web interface. As EV charging infrastructure becomes increasingly critical to transportation and energy systems, insecure management platforms represent a high-value target for disruption or sabotage. The fact that all versions are affected worldwide underscores a systemic failure in secure-by-design development practices for this operational technology (OT) product.