This vulnerability allows public access to charging station authentication identifiers through web‑based mapping platforms. Because authentication identifiers are exposed without sufficient protection, an attacker can read these credentials and potentially authenticate as the charging station, granting unauthorized control or disruption of service. The weakness aligns with CWE‑522, insufficiently protected credentials, which undermines confidentiality and integrity of the authentication data.

The affected product is Mobility46 mobile charging stations provided by Mobility46 (mobility46.se). No specific product version information is provided in the advisory.

The CVSS score is 6.9, indicating a medium risk. The EPSS value is below 1 %, suggesting that documented exploitation is unlikely but should not be ignored. The threat is not yet present in CISA’s KEV catalog. The vulnerability can be exploited by an attacker who can access the public mapping interface; once credentials are acquired, the attacker can log into the charging station’s control system. The lack of authorization controls and the public exposure of credentials are the primary risk factors.