Critical Vulnerabilities in Chargemap Charging Stations Expose Admin Control Risks

Critical Flaws in Chargemap Charging Stations Enable Unauthorized Admin Access

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has disclosed multiple critical vulnerabilities in Chargemap electric vehicle (EV) charging stations that could allow threat actors to gain unauthorized administrative control or disrupt charging services via denial-of-service (DoS) attacks. The advisory, published under ICSA-26-057-05, highlights risks to operational technology (OT) environments in critical infrastructure sectors.

Technical Details

The vulnerabilities affect specific versions of Chargemap charging station firmware (exact versions redacted in the advisory). Successful exploitation could enable attackers to:

• Escalate privileges to administrative levels without authentication.
• Execute arbitrary commands on vulnerable devices.
• Trigger DoS conditions, halting charging operations.

CISA’s advisory references the Common Security Advisory Framework (CSAF) document for technical specifications, available here. While CVE IDs are pending assignment (denoted as CVE-2026-XXXX in the advisory), the flaws are classified as high-severity due to their potential impact on physical infrastructure.

Impact Analysis

Chargemap charging stations are widely deployed across public and private EV charging networks, including critical infrastructure sites such as transportation hubs, healthcare facilities, and government installations. Exploitation of these vulnerabilities could:

• Disrupt EV charging services, leading to operational downtime and financial losses.
• Enable lateral movement into connected OT or IT networks.
• Facilitate physical security risks if attackers manipulate charging station controls (e.g., overloading circuits).

Recommendations

CISA urges organizations to:

1. Apply patches immediately once Chargemap releases firmware updates (monitor CISA’s advisory for updates).
2. Isolate charging stations from corporate networks until mitigations are deployed.
3. Monitor for suspicious activity, including unauthorized access attempts or unusual command executions.
4. Review CSAF documentation for technical indicators of compromise (IoCs) and mitigation strategies.

Security teams should prioritize these vulnerabilities due to their low attack complexity and high potential impact on critical infrastructure. Further details, including CVE assignments, will be updated in CISA’s advisory as they become available.