The vulnerability exposes charging station authentication identifiers that are publicly accessible through web‑based mapping platforms. This sensitive data exposure (CWE‑522) may allow an attacker to obtain credentials that could grant access to the charging station management interface, creating a confidentiality breach and a pathway to compromise integrity or availability of the charging infrastructure. While the official description does not explicitly state that these identifiers enable direct access to the management interface, it is inferred that they could be used for such purposes given the nature of the credentials involved.

The affected product is the EV2GO online platform for electric vehicle charging stations (EV2GO:ev2go.io). No specific version information is provided, so any deployment that leaves authentication identifiers exposed in public mapping services is potentially vulnerable.

The CVSS score of 6.9 indicates moderate risk. The EPSS score is below 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying that no known active exploits are reported. Based on publicly available information, the likely attack vector is a network‑based data collection that requires only reconnaissance of publicly exposed credentials, with no authentication required to access the data.