CVE-2026-40702 is a critical vulnerability in EVoke EVoke CSMS caused by the absence of authentication mechanisms on WebSocket endpoints. This weakness enables attackers to impersonate legitimate charging stations, thereby gaining unauthorized access to sensitive information and executing unauthorized operations. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The CVSS v3.1 base score is 9.4, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and low impact on availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows attackers to impersonate charging stations, leading to unauthorized access to sensitive data and unauthorized actions within the EVoke CSMS environment. This can result in privilege escalation and potentially compromise the entire system's security, affecting confidentiality and integrity with some impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to WebSocket endpoints through network controls and monitor for unauthorized connections. Avoid exposing these endpoints to untrusted networks.