CVE-2026-25114 is a high severity flaw (CVSS 7.5) in CloudCharge, the charging platform from cloudcharge.se. Its WebSocket API does not limit authentication requests, so an attacker may cause denial of service or brute force a way in. CISA says CloudCharge did not respond to its coordination request, and lists no fix.
What's affected
- Affected: CloudCharge cloudcharge.se, all versions, per CISA advisory ICSA-26-057-03.
- Fixed in: no fixed version is listed.
The same advisory lists related issues in the product: missing authentication for a critical function, insufficient session expiration and insufficiently protected credentials. It says successful exploitation could let attackers impersonate charging stations, hijack sessions, suppress or misroute traffic and manipulate data sent to the backend.
How to check if you're exposed
If you operate chargers on CloudCharge, you are in scope. Check whether the WebSocket endpoint is reachable from the internet, and look at authentication logs for unusually high numbers of attempts from one source.
What to do now
- Contact CloudCharge through its support page, as CISA suggests, and ask for a fix timeline.
- Restrict access to the WebSocket endpoint to known charger networks.
- Put a gateway or web application firewall in front of it that rate limits connection and login attempts.
- Monitor for repeated failed authentication, and for chargers that stop reporting.
- Review the other vulnerabilities in the same CISA advisory.
Why it matters
Rate limits are a basic control. Without one, every guessable credential is eventually found, and a flood of requests can crowd out real chargers. The weakness is CWE-307 (Improper Restriction of Excessive Authentication Attempts).
With no vendor response, you carry the risk. Compensating controls, such as limiting who can reach the service and adding your own throttling, are the practical option until a fix exists.
Quick check
Has CloudCharge published a fix?
CISA says the vendor did not respond to its request for coordination. No fix is listed in the advisory.
Is it exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the advisory does not report exploitation.
Sources
Last reviewed: 19 October 2026.
