This vulnerability (CVE-2026-44622) affects the EVoke CSMS product by exposing charging station authentication identifiers publicly via web-based mapping platforms. Classified under CWE-522 (Insufficiently Protected Credentials), it indicates that sensitive authentication data is accessible without proper protection. The CVSS 3.1 base score is 6.5 (medium), with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no impact on availability. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

The exposure of charging station authentication identifiers can lead to unauthorized access or manipulation of charging stations, potentially compromising confidentiality and integrity of the system. However, there is no indication of availability impact or active exploitation. The medium CVSS score reflects a moderate risk due to the ease of access and potential misuse of these identifiers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure of authentication identifiers by restricting access to mapping platforms or removing sensitive data from public views if possible. Monitor vendor communications for updates and apply official patches once released.