This vulnerability allows an attacker to obtain charging station authentication identifiers that are publicly accessible via web-based mapping platforms. Because these credentials are not adequately protected, an adversary could gain unauthorized access to station controls or services. The weakness corresponds to CWE-522, which involves insufficient protection of credentials during storage or transmission, potentially compromising confidentiality of user data and device access. Affected systems

The CTEK Chargeportal product is impacted. No specific version information is provided, so all current releases are considered potentially vulnerable. The product will be sunset in April 2026, after which support will cease. Risk and exploitability

The CVSS score of 6.9 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is remote via the publicly available web interface; this inference comes from the description of credential exposure on web-based mapping platforms. Given the product’s planned discontinuation, the window for exploitation may be limited, but the potential impact remains significant for any remaining installations.