SWITCH EV Charging Stations Insufficiently Protected Credentials Vulnerability

A vulnerability exists in SWITCH EV charging stations, allowing authentication identifiers to be publicly accessed via web-based mapping platforms. This issue could enable attackers to impersonate charging stations, hijack sessions, misroute legitimate traffic, causing large-scale denial-of-service, and manipulate data sent to the backend.

Impact

Exploitation of this vulnerability could allow for impersonation of charging stations, session hijacking, suppression or misrouting of legitimate traffic, causing large-scale denial-of-service, and manipulation of data sent to the backend.

Remediation

SWITCH EV did not respond to CISA's request for coordination. Contact SWITCH EV through their contact page for more information.