CVE-2026-20792 is a high severity flaw (CVSS 7.5) in the Chargemap chargemap.com WebSocket API, which does not limit authentication attempts. That could allow brute force guessing or a denial of service against charger telemetry. CISA says Chargemap did not respond, so no fix is confirmed. Put limits in front of it.
What's affected
CISA advisory ICSA-26-057-05 lists Chargemap chargemap.com as affected in all versions. The weakness is CWE-307 (improper restriction of excessive authentication attempts). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so the scored impact is on availability.
The record says an attacker could suppress or misroute legitimate charger telemetry, or run brute force attacks to gain access. The same advisory lists a missing authentication issue on the WebSocket endpoints, plus insufficient session expiration and unprotected credentials.
CISA says Chargemap did not respond to its request for coordination, so I could not confirm any fixed version. The record does not mark the issue as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
If you run chargers connected to Chargemap, check with your provider whether a fix exists. Look at what you control:
- Backend or gateway logs for bursts of failed authentication attempts on the WebSocket endpoint.
- Whether a reverse proxy or gateway sits in front of the endpoint and can count connections per source address.
- Whether chargers lose their connection during those bursts, which would show up as gaps in telemetry.
What to do now
- Ask Chargemap, through the support page CISA gives, whether a fix exists and when it ships.
- Add rate limiting and connection caps in front of the WebSocket endpoint with a reverse proxy or gateway, per source address and per charger identifier.
- Alert on repeated failed authentications and on telemetry gaps for a charger.
- Apply the CISA recommended practices: no direct internet exposure for control networks, firewalls, and a VPN for remote access.
- Revisit the plan once the vendor publishes a fixed version.
Why it matters
Without a limit on attempts, a guessing attack costs an attacker only time. Rate limiting is cheap to add and usually the first control that a protocol needs once it faces the internet. The weakness is a common one: the check is correct but nothing stops someone from asking a million times.
Here the higher risk is availability. If a flood of authentication requests crowds out real chargers, telemetry is lost or misrouted, and an operator may be unable to see or manage stations. Limits at the edge protect the service even before the vendor ships a change.
Quick check
Is the score high because someone could take over a charger?
No. The vector scores the impact on availability only. The advisory notes brute force as a possible route to access, but the scored harm is service disruption.
Sources
- CISA advisory ICSA-26-057-05: Chargemap chargemap.com
- Chargemap support page
- NVD record for CVE-2026-20792
Last reviewed: 19 October 2026.
