Critical Auth Flaws in EV Charging Station Management System Enable Unauthorized Admin Access
Written by AI from the linked story. Not reviewed by an editor. How this works
The EVoke Systems Charging Station Management System suffers from four critical vulnerabilities rooted in fundamental authentication and session management failures: missing WebSocket authentication, no rate limiting on login attempts, weak session expiration with predictable session identifiers, and publicly exposed charging station credentials. These flaws collectively allow attackers to bypass access controls entirely, brute-force credentials unchallenged, hijack active sessions, or harvest credentials directly from the web interface. As EV charging infrastructure becomes increasingly critical to transportation and energy systems, insecure management platforms represent a high-value target for disruption or sabotage. The fact that all versions are affected worldwide underscores a systemic failure in secure-by-design development practices for this operational technology (OT) product.
Tactical Insight
Immediate actions
- Isolate the CSMS platform behind a VPN or firewall to prevent direct internet exposure until patches are available.
- Rotate all charging station credentials immediately and store them in a secrets management vault rather than on a publicly accessible web platform.
- Implement network-level rate limiting and brute-force protection on all authentication endpoints as a compensating control.
Long-term improvements
- Enforce strong session management standards including cryptographically random session identifiers, short expiration windows, and secure WebSocket authentication for all real-time interfaces.
- Integrate OT/ICS assets like CSMS platforms into a continuous vulnerability management program with CISA ICS advisories as a mandatory feed.
- Apply network segmentation to separate charging infrastructure management systems from corporate IT networks and the public internet.
Detection measures
- Deploy logging and alerting on all authentication events, including failed logins and WebSocket connection attempts, to detect brute-force or session hijacking activity.
- Conduct regular penetration testing and configuration audits specifically targeting authentication mechanisms in OT-facing web platforms.