CVE-2026-25851

published 2026-02-27

CVE-2026-25851: WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the…

Priority P2 71 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

WebSocket endpoints lack proper authentication mechanisms, enabling
attackers to perform unauthorized station impersonation and manipulate
data sent to the backend. An unauthenticated attacker can connect to the
OCPP WebSocket endpoint using a known or discovered charging station
identifier, then issue or receive OCPP commands as a legitimate charger.
Given that no authentication is required, this can lead to privilege
escalation, unauthorized control of charging infrastructure, and
corruption of charging network data reported to the backend.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
chargemap	chargemap.com	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Monitor for unauthenticated WebSocket connections to OCPP endpoints — attacker connects using a known or discovered charging station identifier without any authentication challenge ↗
• → Alert on multiple simultaneous WebSocket sessions sharing the same charging station session identifier, which indicates session hijacking or shadowing activity ↗
• → Detect high-rate authentication attempts against the OCPP WebSocket API endpoint, indicative of brute-force or denial-of-service attacks exploiting the lack of rate limiting ↗
• → Treat charging station identifiers as sensitive credentials — they are publicly discoverable via web-based mapping platforms and can be used directly to impersonate stations on the OCPP WebSocket endpoint ↗

• · All versions of Chargemap chargemap.com are affected; there is no patched version available as the vendor did not respond to CISA coordination requests ↗
• · No known public exploitation has been reported to CISA at time of advisory publication, but the attack requires no authentication, no privileges, and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306