This vulnerability involves the exposure of charging station authentication identifiers via publicly accessible web-based mapping platforms associated with EV Energy's ev.energy product. The identifiers, which should be protected, are accessible without authentication, leading to potential unauthorized access or misuse. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official remediation has been provided, and the product is not a cloud service.

The exposure of authentication identifiers could allow unauthorized parties to identify and potentially misuse charging stations, impacting confidentiality and integrity of the authentication process. However, there is no evidence of active exploitation. The impact does not extend to availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting access to mapping platforms or obfuscating sensitive identifiers if possible. Monitor vendor communications for updates on remediation.