The vulnerability allows attackers to retrieve charging station authentication identifiers that are publicly exposed through web-based mapping platforms. This exposes credentials that could be used to gain unauthorized control over charging stations, potentially compromising the confidentiality and integrity of the IoT infrastructure. The flaw is an instance of Unprotected Credentials, CWE‑522.

The affected product is CloudCharge cloudcharge.se. No specific product versions are listed as impacted.

The CVSS score is 6.9, indicating medium severity. The EPSS score is less than 1%, reflecting a low probability of exploitation at the current time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit the flaw by sending standard web requests to the mapping service, which returns authentication identifiers without requiring authentication or other preconditions.