Ev2Go Charging Stations Insufficiently Protected Authentication Identifiers Vulnerability

A vulnerability exists in Ev2Go charging stations, allowing authentication identifiers to be publicly accessed through web-based mapping platforms. This issue could enable attackers to impersonate charging stations, hijack sessions, misroute legitimate traffic, causing a large-scale denial-of-service, and manipulate data sent to the backend. The vulnerability affects all versions of the Ev2Go service.

Impact

Exploitation of this vulnerability could allow for the impersonation of charging stations, hijacking of sessions, suppression or misrouting of legitimate traffic, leading to a large-scale denial-of-service, and manipulation of data sent to the backend.

Remediation

Ev2Go did not respond to CISA's request for coordination. Contact Ev2Go using their contact page for more information.