CVE-2026-25851: Chargemap chargemap.com Missing Authentication for Critical Function
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25851?
CVE-2026-25851 is considered a high severity vulnerability due to the potential for unauthorized access and data manipulation.
How do I fix CVE-2026-25851?
To mitigate CVE-2026-25851, implement strong authentication mechanisms for the WebSocket endpoints.
What are the risks associated with CVE-2026-25851?
The risks associated with CVE-2026-25851 include unauthorized station impersonation and data manipulation by unauthenticated attackers.
Who is affected by CVE-2026-25851?
CVE-2026-25851 affects users of the Chargemap service that utilizes WebSocket communications for critical functions.
What is the nature of CVE-2026-25851?
CVE-2026-25851 is a missing authentication vulnerability that allows unauthorized access to critical functions via WebSocket endpoints.