CVE-2026-20791

Medium

Published: 27 February 2026

Published

27 February 2026

Modified

05 March 2026

KEV Added

—

Patch

—

CVSS Score 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Score 0.0006 18.0th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-20791 is a medium-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Chargemap Chargemap.Com. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AT-2 Literacy Training and Awareness

addresses: CWE-522

Training instructs users on protecting credentials from disclosure or unauthorized access.

AT-4 Training Records

addresses: CWE-522

Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.

IA-5 Authenticator Management

addresses: CWE-522

Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.

PL-4 Rules of Behavior

addresses: CWE-522

Rules of behavior include credential protection and non-sharing requirements, reducing exposure of insufficiently protected credentials.

PS-4 Personnel Termination

addresses: CWE-522

Terminating or revoking credentials stops use of insufficiently protected or lingering credentials post-termination.

SC-28 Protection of Information at Rest

addresses: CWE-522

Requiring confidentiality/integrity protection for stored credentials directly mitigates insufficiently protected credentials on disk or in configuration stores.

SC-37 Out-of-band Channels

addresses: CWE-522

Credentials or keys delivered out-of-band are not exposed to interception or inadequate protection on the main transport.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1552 Unsecured Credentials Credential Access

Adversaries may search compromised systems to find and obtain insecurely stored credentials.

attack.mitre.org →

Why these techniques?

Public exposure of auth identifiers via web platforms directly enables T1190 (exploit public-facing app) and T1552 (unsecured credentials discovery/use).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

Deeper analysisAI

CVE-2026-20791 is a vulnerability in which authentication identifiers for charging stations are publicly accessible via web-based mapping platforms. This issue, linked to CWE-522 (Insufficiently Protected Credentials), affects charging station systems and was published on 2026-02-27 with a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating medium severity with network accessibility, low complexity, and impacts to confidentiality and integrity but not availability.

Any unauthenticated attacker with network access can exploit this vulnerability without user interaction. By accessing the publicly exposed authentication identifiers through mapping platforms, they can achieve low-level confidentiality breaches, such as viewing sensitive station data, and limited integrity impacts, potentially allowing unauthorized modifications to station configurations or operations.

CISA's ICS Advisory ICSA-26-057-05, detailed at https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-05 and in CSAF format at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-05.json, provides information on mitigations. The ChargeMap support page at https://chargemap.com/en-us/support offers related guidance for affected users.