Critical Flaws in Chargemap EV Chargers Enable Remote Hijacking and DoS

As the world accelerates toward a greener future, the cybersecurity of our Electric Vehicle (EV) supply chain has hit a critical roadblock. Recently, CISA released an alarming advisory regarding Chargemap, a major player in the EV charging infrastructure. A set of vulnerabilities—collectively scoring up to 9.4 CRITICAL on the CVSS scale—has exposed a harsh reality: our charging stations are not just physical plugs, they are networked computers, and right now, some of them are unlocked and open to attack.

The implications are severe. Successful exploitation could allow threat actors to seize administrative control over charging stations, manipulate charging data, or simply shut down operations via Denial-of-Service (DoS) attacks. What makes this situation even more volatile is the vendor's lack of response to coordination efforts, leaving the defense squarely in the hands of the organizations deploying these devices.

Vulnerability Analysis: The Mechanics of the Attack

The advisory outlines four distinct CVEs (CVE-2026-25851, CVE-2026-20792, CVE-2026-25711, CVE-2026-20791) that, when chained together, create a devastating attack vector.

1. The Open Door (CVE-2026-25851)

The most severe flaw (CVSS 9.4) lies in the WebSocket endpoints used for the Open Charge Point Protocol (OCPP). This protocol is the language chargers use to talk to the backend. Shockingly, these endpoints lack proper authentication mechanisms. An attacker doesn't need to crack a password; they simply need the identifier of a charging station (Box ID). Once they have that, they can connect to the backend, impersonate the charger, and issue arbitrary commands.

2. Finding the Keys (CVE-2026-20791)

You might ask, "How does the attacker get the Box ID?" That's where CVE-2026-20791 (CVSS 6.5) comes in. Charging station identifiers are publicly accessible via web-based mapping platforms. This means the "secret" required to exploit the critical vulnerability is actually public data.

3. The Brute Force and the Session Hijack

• CVE-2026-20792 (CVSS 7.5): The API lacks rate limiting. Attackers can launch brute-force attacks or overwhelm the system with requests to cause DoS conditions.
• CVE-2026-25711 (CVSS 7.3): The backend allows multiple connections using the same session identifier. This enables "session shadowing." An attacker can connect using a valid ID, displace the legitimate charging station's session, and intercept commands meant for the physical hardware.

Vendor Status

Crucially, Chargemap did not respond to CISA's request for coordination. This means there is currently no official vendor patch available for these flaws. Defenders must rely entirely on network segmentation and monitoring to survive this exposure window.

Detection and Threat Hunting

Since there is no patch to apply, active threat hunting is your primary defense. We need to identify suspicious OCPP connections, specifically looking for rapid authentication attempts or connections originating from unexpected geolocations.

Hunting for Anomalous Authentication Attempts (KQL)

Use this query in Microsoft Sentinel or Defender to detect potential brute-force activity or rapid connection attempts associated with CVE-2026-20792.

DeviceNetworkEvents
| where RemoteUrl contains "chargemap.com" 
| where ActionType in ("ConnectionAllowed", "ConnectionSuccess")
| summarize Count = count() by SourceIP, DestinationPort, bin(TimeGenerated, 5m)
| where Count > 10 // Threshold for rate limiting detection
| project TimeGenerated, SourceIP, DestinationPort, Count
| order by Count desc

Checking for Exposed Charging Station Identifiers (Python)

Administrators can use this Python script to scan their own logs or public data (if legally permissible) to check if their specific Station IDs are being exposed in a way that facilitates CVE-2026-20791. Note: This script parses a CSV export of station data to check for exposure flags.

import csv
import re

def check_station_exposure(csv_file):
    """Checks a list of charging stations for publicly accessible identifiers."""
    vulnerable_stations = []
    
    try:
        with open(csv_file, mode='r', encoding='utf-8') as file:
            reader = csv.DictReader(file)
            for row in reader:
                station_id = row.get('station_id')
                is_public = row.get('visibility', '').lower() == 'public'
                
                if station_id and is_public:
                    # Simulated check: In reality, you might cross-reference with public maps
                    print(f"[!] VULNERABLE: Station ID {station_id} is publicly visible.")
                    vulnerable_stations.append(station_id)
    except FileNotFoundError:
        print("Error: CSV file not found.")
    except Exception as e:
        print(f"An error occurred: {e}")

    return vulnerable_stations

# Example usage
if __name__ == "__main__":
    # Replace 'stations.csv' with your actual data export
    check_station_exposure('stations.csv')

Network Segmentation Verification (Bash)

To mitigate the lack of authentication, ensure your charging infrastructure is strictly isolated. This command checks if common firewall rules are blocking direct internet access to management ports.

#!/bin/bash
# Check if iptables is blocking outbound OCPP traffic (default port 8000/80) to unauthorized IPs

echo "Checking firewall rules for OCPP ports (80, 443, 8000)..."

# List rules related to common HTTP/WS ports
sudo iptables -L OUTPUT -v -n | grep -E 'dpt:(80|443|8000)'

# Check for established connections to external Chargemap endpoints
echo "Current established connections to Chargemap endpoints:"
ss -tn | grep -E 'chargemap\.com|:80 |:443 |:8000 '

Mitigation Strategies

With no vendor fix available, containment is the only cure.

1. Network Isolation (Critical): Immediately ensure all control system networks and charging stations are behind firewalls. They must be isolated from business networks and, ideally, the open internet. Use a Demilitarized Zone (DMZ) or a strictly monitored jump box for any necessary connectivity.
2. VPNs for Remote Access: If remote access is required for maintenance, it must go through a secure VPN. However, recognize that a VPN is only as secure as the endpoint connecting to it. Ensure these endpoints are hardened.
3. Ingress/Egress Filtering: Configure firewalls to only allow necessary OCPP traffic (usually on specific ports like 8000 or 443) to known, trusted backend IP addresses. Block all other traffic.
4. Monitor for Session Anomalies: Implement monitoring to detect if a single Station ID connects from multiple IP addresses simultaneously, a clear indicator of session hijacking (CVE-2026-25711).

Conclusion

The Chargemap vulnerabilities serve as a stark reminder that as IT and OT converge, the attack surface expands. The lack of vendor cooperation regarding CVE-2026-25851 and its associated flaws places a heavy burden on asset owners. You must assume your chargers are targeted and act now to segment your network before an attacker turns your infrastructure into a botnet.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub