CVE-2026-25851: Chargemap chargemap.com Missing Authentication for Critical Function

Overview

CVE-2026-25851 is a missing authentication issue (CWE-306) in WebSocket endpoints used by Chargemap chargemap.com. According to the record, the OCPP WebSocket endpoint can be reached using a charging station identifier that is known or discovered, without any authentication step. The CNA entry is ICS-CERT, and the record has source status Modified.

Impact

The record describes three main consequences:

• Unauthorized station impersonation, where a client acts as a legitimate charger.
• Manipulation of data sent to the backend, which may corrupt charging network records.
• Possible privilege escalation and unauthorized control of charging infrastructure.

The NVD base score is 9.8 (critical), with high confidentiality, integrity and availability impact and no privileges or user interaction required. The SSVC entry in the record marks the technical impact as total and the attack as automatable.

Affected products and versions

• Product: Chargemap Chargemap.com.
• The record lists the affected versions as not specified by the source, and also as all versions. No version numbers are provided in the record.
• The record contains no fixed versions. This does not mean no fix exists; it means the record does not state one.

Check the vendor support page for current guidance: Chargemap support.

Exploitation status

The KEV catalog entry in the record is not listed. No confirmed active exploitation or exploitation in the wild is stated in the sources consulted. The EPSS probability is about 0.98 percent with a percentile of about 62 percent, and the SSVC exploitation field is none. These are estimates and do not confirm real-world attacks.

Remediation and mitigation

The record does not describe a vendor patch. Defensive measures that operators can consider include:

• Follow the advisory and vendor guidance in CISA ICS advisory ICSA-26-057-05 and the Chargemap support page.
• Restrict network exposure of charging station management and OCPP endpoints, allowing access only from trusted networks and segments.
• Inventory charging stations and backend connections, and validate that only expected chargers communicate with the backend.
• Coordinate with the vendor to confirm whether authentication controls can be enabled or whether a fix is available.

Detection guidance

• Monitor OCPP WebSocket connections for charger identifiers connecting from unexpected sources, or from multiple sources at once.
• Review backend logs for station sessions that lack expected authentication events or that report inconsistent charging data.
• Alert on abrupt changes in charging network records that do not match physical station activity.

Limitations of the available information

The record does not identify specific affected versions or fixed versions, does not describe the exact authentication mechanism involved, and contains no vendor patch details. The sources consulted do not confirm exploitation. Some product version labels in the record are generic and should be verified directly with the vendor.

Frequently asked questions

What is CVE-2026-25851?

It is a missing authentication issue (CWE-306) in Chargemap chargemap.com WebSocket endpoints, including the OCPP endpoint, which can allow unauthenticated station impersonation.

Is this vulnerability being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed active exploitation is stated in the sources consulted.

Which versions are affected and is there a fix?

The record does not specify version numbers and lists no fixed versions. Confirm current status directly with the vendor support page.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.