The vulnerability arises because the OCPP v1.6 service communicates without authentication, which allows an attacker with knowledge of the protocol to obtain information about the charger. This reflects the weakness classified as CWE‑201, a lack of authentication that permits an unauthorized party to obtain sensitive information.

EFACEC’s QC 60, QC 90, and QC 120 charging units are affected. No specific firmware or software version information was supplied, so all currently deployed units that use the unprotected OCPP v1.6 interface may be vulnerable.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is reported as less than 1 %, suggesting a low probability of exploitation at the current time. The vulnerability is not listed in the KEV catalog, so no known active exploitation has been reported. The likely attack vector is network-based, with an adversary needing only access to the OCPP interface and some knowledge of the protocol to extract charger information.