CVE-2026-20792

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20792", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-02-20T18:28:15.455Z", "datePublished": "2026-02-26T23:06:29.969Z", "dateUpdated": "2026-03-05T19:42:31.634Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "chargemap.com", "vendor": "Chargemap", "versions": [{"status": "affected", "version": "All versions"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The WebSocket Application Programming Interface lacks restrictions on \nthe number of authentication requests. This absence of rate limiting may\n allow an attacker to conduct denial-of-service attacks by suppressing \nor misrouting legitimate charger telemetry, or conduct brute-force \nattacks to gain unauthorized access."}], "value": "The WebSocket Application Programming Interface lacks restrictions on \nthe number of authentication requests. This absence of rate limiting may\n allow an attacker to conduct denial-of-service attacks by suppressing \nor misrouting legitimate charger telemetry, or conduct brute-force \nattacks to gain unauthorized access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "description": "CWE-307", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-03-05T19:42:31.634Z"}, "references": [{"url": "https://chargemap.com/en-us/support"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-05"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-05.json"}], "source": {"advisory": "ICSA-26-057-05", "discovery": "EXTERNAL"}, "title": "Chargemap chargemap.com Improper Restriction of Excessive Authentication Attempts", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Chargemap did not respond to CISA's request for coordination. Contact \nChargemap using their contact page here: \n<a target=\"_blank\" rel=\"nofollow\" href=\"https://chargemap.com/en-us/support\">https://chargemap.com/en-us/support</a> for more information.\n\n<br>"}], "value": "Chargemap did not respond to CISA's request for coordination. Contact \nChargemap using their contact page here: \n https://chargemap.com/en-us/support for more information."}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T20:40:34.501288Z", "id": "CVE-2026-20792", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T20:40:42.168Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20792", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T20:40:34.501288Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T20:40:38.216Z"}}], "cna": {"title": "Chargemap chargemap.com Improper Restriction of Excessive Authentication Attempts", "source": {"advisory": "ICSA-26-057-05", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Chargemap", "product": "chargemap.com", "versions": [{"status": "affected", "version": "All versions"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://chargemap.com/en-us/support"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-05"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-05.json"}], "workarounds": [{"lang": "en", "value": "Chargemap did not respond to CISA's request for coordination. Contact \nChargemap using their contact page here: \n https://chargemap.com/en-us/support for more information.", "supportingMedia": [{"type": "text/html", "value": "Chargemap did not respond to CISA's request for coordination. Contact \nChargemap using their contact page here: \n<a target=\"_blank\" rel=\"nofollow\" href=\"https://chargemap.com/en-us/support\">https://chargemap.com/en-us/support</a> for more information.\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The WebSocket Application Programming Interface lacks restrictions on \nthe number of authentication requests. This absence of rate limiting may\n allow an attacker to conduct denial-of-service attacks by suppressing \nor misrouting legitimate charger telemetry, or conduct brute-force \nattacks to gain unauthorized access.", "supportingMedia": [{"type": "text/html", "value": "The WebSocket Application Programming Interface lacks restrictions on \nthe number of authentication requests. This absence of rate limiting may\n allow an attacker to conduct denial-of-service attacks by suppressing \nor misrouting legitimate charger telemetry, or conduct brute-force \nattacks to gain unauthorized access.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-03-05T19:42:31.634Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20792", "state": "PUBLISHED", "dateUpdated": "2026-03-05T19:42:31.634Z", "dateReserved": "2026-02-20T18:28:15.455Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-02-26T23:06:29.969Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "chargemap.com", "vendor": "Chargemap", "versions": [{"status": "affected", "version": "All versions"}]}], "source": "ics-cert@hq.dhs.gov"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:chargemap:chargemap.com:*:*:*:*:*:*:*:*", "matchCriteriaId": "BBD91DDB-F7D6-4D65-87B7-47B954DD1F51", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WebSocket Application Programming Interface lacks restrictions on \nthe number of authentication requests. This absence of rate limiting may\n allow an attacker to conduct denial-of-service attacks by suppressing \nor misrouting legitimate charger telemetry, or conduct brute-force \nattacks to gain unauthorized access."}, {"lang": "es", "value": "La Interfaz de Programaci\u00f3n de Aplicaciones WebSocket carece de restricciones sobre el n\u00famero de solicitudes de autenticaci\u00f3n. Esta ausencia de limitaci\u00f3n de velocidad puede permitir a un atacante llevar a cabo ataques de denegaci\u00f3n de servicio al suprimir o redirigir err\u00f3neamente la telemetr\u00eda leg\u00edtima del cargador, o realizar ataques de fuerza bruta para obtener acceso no autorizado."}], "id": "CVE-2026-20792", "lastModified": "2026-06-17T10:17:47.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20792", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T20:40:34.501288Z", "version": "2.0.3"}}]}, "published": "2026-02-27T00:16:56.180", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Product"], "url": "https://chargemap.com/en-us/support"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory"], "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-05.json"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-05"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "chargemap.com", "source": "cna", "vendor": "Chargemap"}, "product": "chargemap.com", "vendor": "chargemap"}], "analysis": {"en": {"generated_at": "2026-04-16T15:53:56.578259+00:00", "value": {"mitigation_remediation": ["Implement authentication rate limiting on the WebSocket endpoint to restrict the number of authentication attempts per IP or per client within a given timeframe.", "Add a short temporary lockout or exponential back\u2011off for repeated failed authentication attempts to reduce brute\u2011force effectiveness.", "Contact Chargemap support via their contact page for an official patch or detailed guidance; attack mitigation can be coordinated with them.", "Monitor authentication logs for abnormal spikes and investigate potential scanning or brute\u2011force activity."], "summary": {"action": "Apply Rate Limit", "impact": "Denial of Service and potential credential compromise"}, "threat_synthesis": {"affected_systems": "Chargemap\u2019s Cargemap.com service. No specific version numbers are listed; the issue applies to the WebSocket endpoint used for charger telemetry and client authentication.", "description_and_impact": "The vulnerability exists in the WebSocket API of Chargemap\u2019s application, which does not enforce any limit on the number of authentication attempts. Because users can send unlimited authentication requests, an attacker can flood the service with requests, causing denial of service or diverting telemetry from legitimate chargers. Additionally, the absence of rate limiting allows brute\u2011force attempts to obtain valid credentials and potentially gain unauthorized access.", "risk_and_exploitability": "The CVSS score of 8.7 rates the vulnerability as high, while the EPSS score indicates a very low probability of exploitation in the near term. Because the attack can be carried out from any remote system that can reach the WebSocket endpoint, it is an external remote vulnerability. The lack of a CISA KEV listing suggests that no known active exploit is published; however, the potential to disrupt service or compromise credentials remains significant."}}}}, "created": "2026-02-27T09:03:39.927057+00:00", "updated": "2026-04-16T16:00:13.872738+00:00", "vendors": ["chargemap", "chargemap$PRODUCT$chargemap.com"]}