What is the CVSS score of CVE-2026-25711?

CVE-2026-25711 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Chargemap.Com are affected by CVE-2026-25711?

A vulnerability in our WebSocket backend allows unauthorized session hijacking through charging station identifier spoofing, enabling attackers to intercept or manipulate charging operations and…

How to fix or mitigate CVE-2026-25711?

Within 24 hours: Isolate affected WebSocket endpoints from production traffic and enable enhanced logging on all WebSocket connections to detect exploitation attempts. Within 7 days: Deploy network segmentation to restrict WebSocket access to authorized networks only and implement strict session validation controls at the application layer. Within 30 days: Coordinate with the vendor for patch availability, conduct a full security audit of session management mechanisms, and deploy additional monitoring to detect anomalous session behavior.

Chargemap.Com CVE-2026-25711

HIGH

Insufficient Session Expiration (CWE-613)

2026-02-27 ics-cert@hq.dhs.gov

Authentication Bypass Chargemap.Com

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 00:16 nvd

HIGH 7.3

DescriptionCVE.org

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

AnalysisAI

Chargemap.Com's WebSocket backend accepts multiple connections with identical session identifiers, allowing attackers to hijack charging station sessions and intercept backend commands through predictable identifier prediction. An unauthenticated remote attacker can impersonate legitimate charging stations, execute unauthorized operations, or disrupt service availability by flooding the backend with crafted session requests. No patch is currently available.

Technical ContextAI

Classified as CWE-613 (Insufficient Session Expiration). Affects Chargemap.Com. The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station. This vulnerability may allow unauthorized users to authenticate as other users or enable a