CVE-2025-55705 is an insufficient session expiration flaw in EVMAPA's charging station backend, scored CVSS 7.3 (high). The backend allowed several connections with one charging station ID. EVMAPA told CISA it has resolved the issue, so operators should confirm that with the vendor.
What's affected
The CISA advisory ICSA-26-022-08, released 22 January 2026, lists EVMAPA with all versions as known affected for this CVE. It covers three flaws in the product: CVE-2025-54816 (missing authentication on a WebSocket endpoint, CVSS 9.4), CVE-2025-53968 (no limit on authentication attempts) and this one.
The record describes the weakness this way: the system lets several connections use the same charging station ID at once, so a valid ID could be reused to open concurrent sessions. The advisory notes deployments in Czechia and Slovakia in the transportation sector.
How to check if you're exposed
This is a hosted service flaw, so version checks matter less than vendor confirmation and network review.
- If you operate chargers on an EVMAPA backend, ask the vendor in writing whether the one-connection-per-station-ID rule is active for your tenant. EVMAPA told CISA it no longer allows simultaneous connections with the same ID.
- Review how your chargers connect. CISA notes that operators can use WebSocket Secure, and that EVMAPA connects stations it supplies over its own VPN.
- Look at backend logs for the same station ID connecting from two sources at once.
What to do now
- Contact EVMAPA and confirm the fix for CVE-2025-55705 and the vendor position on CVE-2025-54816 and CVE-2025-53968.
- Use WebSocket Secure for station connections where your hardware allows it.
- Keep control system networks off the public internet and behind firewalls, as CISA recommends, and use a VPN for remote access.
- Monitor for duplicate station ID sessions and alert on them.
- Keep the CISA advisory in your register and review it when EVMAPA updates its position.
Why it matters
The class is CWE-613, insufficient session expiration. A station ID acts like a credential here. If the backend accepts a second live session on the same ID, a party who learns the ID can sit beside the real charger and send or receive data as it.
The record lists unauthorized access, data inconsistency and manipulation of charging sessions as the possible effects. CISA's wider advisory says exploitation of the three issues could lead to degraded service, denial of service or unauthorized remote command execution. Billing and availability are the practical stakes for charge point operators. The KEV flag for this CVE is false.
Quick check
Is this vulnerability exploited in the wild?
The record's KEV flag is false and the CISA advisory text I read does not say it is exploited.
Sources
Last reviewed: 19 October 2026.
