WebSocket Endpoint Vulnerability in Charge Map's Charging Stations
CVE-2026-25851

9.3CRITICAL

Key Information:

Vendor

Chargemap

Status
Chargemap.com
Vendor
CVE Published:
26 February 2026

What is CVE-2026-25851?

A vulnerability in the WebSocket endpoints of Charge Map's charging stations allows attackers to impersonate legitimate devices. This flaw enables unauthorized users to connect to the OCPP WebSocket endpoints using known charging station identifiers, granting them the ability to issue and receive OCPP commands as if they were legitimate devices. The absence of necessary authentication mechanisms facilitates privilege escalation, unauthorized control, and potential corruption of vital charging network data reported to the backend. This vulnerability poses significant risks to the integrity of charging stations and the overall stability of the charging infrastructure.

Affected Version(s)

chargemap.com All versions

References

https://chargemap.com/en-us/support
https://www.cisa.gov/news-events/ics-advisories/icsa-26-0...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA
.