The vulnerability arises when authentication identifiers used by the Everon charging station are publicly accessible through web-based mapping platforms. This insufficient protection of credentials allows an attacker to obtain sensitive credential information, potentially facilitating unauthorized access or fraudulent activity. The weakness is classified under CWE-522, indicating a lack of secure storage and protection for authentication data.

The affected system is Everon’s API platform (api.everon.io), with no specific product or version details provided; the issue is associated with the platform’s handling of authentication identifiers.

The CVSS score of 6.9 denotes a moderate severity, while the EPSS score of less than 1% indicates a very low probability of exploitation at present. The CVE is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. The likely attack vector is remote, involving publicly available web mapping services that expose sensitive authentication data. Because the platform was shut down on December 1, 2025, the immediate risk is mitigated, but the underlying exposure would remain if the system were reactivated without remediation.