How to Fix CVE-2026-25851: chargemap.com (Bundle Sibling)

By Sai Kiran Pandrala. Last verified: 2026-05-25.

CVE-2026-25851 is a sibling vulnerability in the same vendor advisory as CVE-2026-20791. Apply the same patched build and you close both. The technical detail below is what differs.

What's different about CVE-2026-25851?

WebSocket endpoints lack proper authentication mechanisms, enabling

attackers to perform unauthorized station impersonation and manipulate

data sent to the backend. An unauthenticated attacker can connect to the

OCPP WebSocket endpoint using a known or discovered charging station

identifier, then issue or receive OCPP commands as a legitimate charger.

Given that no authentication is required, this can lead to privilege

escalation, unauthorized control of charging infrastructure, and

corruption of charging network data reported to the backend.

How to fix CVE-2026-25851

Apply the patched build per the primary write-up: How to Fix CVE-2026-20791. All commands, verification steps, and rollback notes for chargemap.com are listed there.

Frequently asked questions

Does the CVE-2026-20791 patch close CVE-2026-25851?

Yes. Both CVEs are addressed by the same vendor patch. Applying the patched build closes the full bundle.

Is CVE-2026-25851 listed in CISA KEV?

No public KEV listing at the time of this writing.

Where is the official advisory?

See https://chargemap.com/en-us/support

References

• Official vendor advisory: https://chargemap.com/en-us/support
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-25851
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Primary: How to Fix CVE-2026-20791

*Written by Sai Kiran Pandrala. Part of the chargemap.com bundle. Full procedure at how-to-fix-cve-2026-20791.*