The vulnerability arises from a lack of hardening in the operating system, enabling the user assigned to manage and maintain the charger to access a variety of files that contain clear‑text credentials and other sensitive information. This can lead to unauthorized disclosure of authentication details and asset data, potentially compromising the integrity and confidentiality of the surrounding environment. The weakness is cataloged as CWE‑497, indicating improper handling of data that may be exposed to privileged users.

The flaw affects systems running EFACEC QC 60, QC 90, and QC 120 firmware. No specific version numbers are disclosed, so the entire product line may be vulnerable until hardening measures are applied.

With a CVSS v3 score of 6.8, the severity is moderate, reflecting the potential impact if an attacker gains sufficient access. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or privileged, requiring an operator or maintenance user to read the exposed files. Despite the low exploitation probability, the nature of the disclosed information warrants urgent remediation.