Eparking Fi CVE-2026-31926

The CVSS 3.1 score of 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N reflects a moderate severity with notable concerning characteristics: the attack vector is network-based requiring no privileges or user interaction, and the attack complexity is low, meaning no special conditions are required for exploitation. However, the scope is unchanged and availability impact is none, capping the severity at 6.5 rather than higher. The information disclosure tag and CWE-522 classification indicate this is fundamentally a credential exposure issue with limited immediate integrity impact. Without access to EPSS scores or KEV status confirmation, the real-world exploitation probability cannot be quantitatively assessed, but the low attack complexity and public nature of the exposure vector (web-based mapping platforms) suggest this is discoverable by opportunistic attackers. The primary risk stems from exposed authentication identifiers potentially enabling unauthorized access to charging infrastructure or downstream account compromise if credentials are reused. This should be treated as a moderate-priority issue requiring prompt remediation, but not as an emergency critical vulnerability given the lack of confirmed active exploitation and absence of availability impact.

An attacker discovers the eparking.fi web-based mapping platform and identifies that charging station authentication identifiers are publicly accessible without authentication (AV:N, PR:N, UI:N). The attacker methodically enumerates and extracts the exposed identifiers by parsing responses from the mapping interface or analyzing client-side code. With these identifiers, the attacker can then attempt to authenticate to charging infrastructure directly, potentially gaining unauthorized access to account management functions, billing systems, or usage data, or leveraging the compromised credentials for lateral movement into connected backend systems. No sophisticated exploitation techniques or user interaction are required, making this a feasible attack for opportunistic threat actors with basic reconnaissance capabilities.