CVE-2026-25774 identifies a vulnerability in the EV Energy ev.energy product where charging station authentication identifiers are publicly exposed via web-based mapping platforms. This exposure stems from insufficient protection of credentials (CWE-522), allowing attackers to obtain sensitive authentication data without requiring any privileges or user interaction. The vulnerability affects all versions of the product and can be exploited remotely over the network. The authentication identifiers are critical for controlling and managing charging stations, and their public availability could enable unauthorized entities to impersonate legitimate users or manipulate charging station operations. Although there is no evidence of active exploitation, the vulnerability presents a risk to confidentiality and integrity, potentially allowing attackers to track usage patterns, disrupt billing, or interfere with charging sessions. The CVSS 3.1 base score of 6.5 reflects a medium severity, considering the vulnerability's network accessibility, lack of required privileges, and the limited scope of impact on availability. The vulnerability was published on February 27, 2026, and no patches or mitigations have been officially released yet.

The primary impact of this vulnerability is the compromise of confidentiality and integrity of charging station authentication identifiers. Unauthorized access to these identifiers could allow attackers to impersonate legitimate users or devices, potentially leading to fraudulent use of charging stations, manipulation of charging sessions, or unauthorized tracking of user behavior. While availability is not directly affected, the integrity compromise could indirectly disrupt normal operations or billing processes. Organizations deploying ev.energy solutions may face reputational damage, financial losses, and regulatory scrutiny if sensitive data is misused. The vulnerability could also undermine trust in EV infrastructure security, especially as electric vehicle adoption grows globally. The risk is heightened in regions with dense EV charging networks and widespread use of ev.energy products.

Until official patches are released, organizations should implement compensating controls such as restricting access to web-based mapping platforms that expose authentication identifiers, using network segmentation to limit exposure of charging station management interfaces, and monitoring for unusual access patterns or unauthorized use of charging stations. Employing strong authentication and authorization mechanisms at the application layer can help mitigate risks from exposed identifiers. Additionally, organizations should engage with EV Energy for timely updates and patches, conduct regular security audits of their EV infrastructure, and educate users about the risks of sharing sensitive charging station information publicly. Implementing anomaly detection systems to identify suspicious activities related to charging stations can also reduce potential exploitation.