CVE-2026-25851 is a missing authentication flaw in Chargemap's OCPP WebSocket endpoints, rated 9.4. Anyone who knows or finds a charging station identifier can connect and act as that charger. CISA published an advisory, and the record lists no fixed version, so contact the vendor.
What's affected
- Product: Chargemap, the electric vehicle charging network backend (chargemap.com).
- Affected: the WebSocket endpoints that speak OCPP, per the CISA advisory.
- Fixed version: not stated in the record. Use the CISA ICS advisory and the vendor's support page.
- Consequence named: station impersonation, unauthorised control and corrupted data.
How to check if you're exposed
This is a vendor hosted service, so you cannot patch it yourself. If you operate chargers connected to Chargemap, ask the vendor in writing which endpoints and station identifiers are affected, and whether they have added authentication. Review the CISA ICS advisory ICSA-26-057-05 for the vendor's response and any mitigations.
What to do now
- Read the CISA advisory ICSA-26-057-05 in full.
- Contact Chargemap support to confirm the fix status for your stations.
- Ask whether your station identifiers are guessable, and request unique, unpredictable ones where possible.
- Monitor your backend for charger sessions or status messages that do not match physical stations.
- Follow CISA's general guidance for ICS: do not expose control systems directly, and use network segmentation.
Why it matters
The class is CWE-306, missing authentication for a critical function. OCPP is the protocol chargers use to talk to a central system. If the central endpoint accepts any client that names a station, then a person can pose as a legitimate charger, send false data or receive commands meant for the real one.
The CISA advisory frames the risk as privilege escalation, unauthorised control and corrupted network data. Charging networks tie into payments and grid operations, so integrity matters. The record does not mark this CVE as exploited in the wild, and it is not in CISA KEV.
Quick check
Can I fix this myself?
No. The flaw is in the vendor's WebSocket service, so the fix has to come from the vendor. You can reduce risk by monitoring and by asking for per station credentials.
Sources
Last reviewed: 19 October 2026.
