The vulnerability enables an attacker to discover charging station authentication identifiers through publicly accessible web‑based mapping platforms. Because these IDs are not protected, the exposure can lead to credential compromise, granting unauthorized access to station functions or data. The weakness is categorized as CWE‑522 and presents a moderate confidentiality risk.

EV Energy’s ev.energy charging station platform is affected; no specific version information is supplied, so all releases of the platform should be considered at risk.

This issue receives a CVSS score of 6.9, indicating moderate severity. The EPSS score is less than 1%, reflecting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, involving web traffic that exposes credential data via mapping services, and requires the attacker to access or probe the public mapping URLs in order to retrieve authentication identifiers.