CVE-2026-20791

Medium

Published: 27 February 2026

Published

27 February 2026

Modified

05 March 2026

KEV Added

—

Patch

—

CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0006 18.4th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-20791 is a medium-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Chargemap Chargemap.Com. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2026-20791 is a vulnerability in which authentication identifiers for charging stations are publicly accessible via web-based mapping platforms. This issue, linked to CWE-522 (Insufficiently Protected Credentials), affects charging station systems and was published on 2026-02-27 with a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating medium severity with network accessibility, low complexity, and impacts to confidentiality and integrity but not availability.

Any unauthenticated attacker with network access can exploit this vulnerability without user interaction. By accessing the publicly exposed authentication identifiers through mapping platforms, they can achieve low-level confidentiality breaches, such as viewing sensitive station data, and limited integrity impacts, potentially allowing unauthorized modifications to station configurations or operations.

CISA's ICS Advisory ICSA-26-057-05, detailed at https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-05 and in CSAF format at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-05.json, provides information on mitigations. The ChargeMap support page at https://chargemap.com/en-us/support offers related guidance for affected users.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-8930

Vulnerability details

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

CWE(s): CWE-522

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1552 Unsecured Credentials Credential Access

Adversaries may search compromised systems to find and obtain insecurely stored credentials.

attack.mitre.org →

Why these techniques?

Public exposure of auth identifiers via web platforms directly enables T1190 (exploit public-facing app) and T1552 (unsecured credentials discovery/use).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1