What is the CVSS score of CVE-2026-28204?

CVE-2026-28204 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Chargeportal are affected by CVE-2026-28204?

CVE-2026-28204 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

Chargeportal CVE-2026-28204

EUVD-2026-13850 MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-03-20 icscert

Information Disclosure Chargeportal

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 23:16 euvd

EUVD-2026-13850

Analysis Generated

Mar 20, 2026 - 23:16 vuln.today

CVE Published

Mar 20, 2026 - 22:47 nvd

MEDIUM 6.5

DescriptionCVE.org

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

AnalysisAI

Authentication identifiers for electric vehicle charging stations are publicly exposed through web-based mapping platforms, allowing unauthenticated network-based access to sensitive authentication data. The vulnerability affects CTEK ChargePortal and enables attackers to obtain charging station credentials without requiring any privileges or user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	The CVSS 3.1 score of 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N indicates a medium-severity vulnerability with moderate real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker discovers CTEK charging stations listed on public mapping platforms and extracts exposed authentication identifiers directly from the platform's data or through automated scraping. Using these credentials, the attacker gains unauthorized access to the ChargePortal management interface to monitor charging activity, redirect billing, or disable specific charging stations. …
Remediation	Immediately contact CTEK support (https://www.ctek.com/support) to obtain and deploy the latest patched version of ChargePortal that implements proper credential protection and removes authentication identifiers from public mapping platform integration. … Detailed patch versions, workarounds, and compensating controls in full report.