Technical impact
A flaw exists in the IGL‑Technologies eParking.fi charging‑station software that allows authentication identifiers to be publicly visible through web‑based mapping platforms. This results in the disclosure of credentials which can enable unauthorized access to charging station functions, potentially leading to fraudulent usage, service disruption, or theft of charging data. The weakness is an example of insecure storage or transmission of credentials (CWE‑522).
Affected Systems
The affected product is the IGL‑Technologies eParking.fi OCPP server component. The risk applies to installations using the standard, unencrypted deployment of the servers; encrypted deployments or the proprietary eTolppa protocol are not impacted. No specific version range is supplied, but the advisory indicates that a recent proprietary patch has been issued to address the issue.
Risk and Exploitability
The CVSS score of 6.9 indicates a moderate severity risk. While EPSS data is not provided and the vulnerability is not listed in the CISA KEV catalog, the publicly exposed credentials make exploitation relatively straightforward for an attacker who can discover the mapping platform. The likelihood of exploitation is inferred to be moderate, given that a publicly available credential object can be captured without authentication. The impact is primarily confidentiality breach of credentials, with secondary risks of availability and integrity if the compromised credentials are used to manipulate charging sessions.
