The vulnerability exposes WebSocket endpoints that handle OCPP commands without any authentication. Attackers can connect to the endpoint with a valid or guessed charger identifier and send or receive commands as if they were an authentic station. This permits privilege escalation, allowing an unauthenticated user to issue control commands to charging infrastructure, disrupt service, or alter data that the backend records.

The affected product is Chargemap’s chargemap.com platform, specifically the WebSocket interfaces used by OCPP charging stations. Version information is not provided; therefore the vulnerability may affect all existing deployments of the platform until a fix is released.

The CVSS score of 9.3 indicates high severity, but the EPSS score of less than 1% suggests that exploitation is currently rare or not widely observed. The lack of authentication removes the need for credential theft, making the attack straightforward for anyone who can reach the public WebSocket endpoint. Because the vulnerability is not listed in the CISA KEV catalog, no publicly known exploit code is available yet, yet the potential for widespread disruption remains high.