What is the CVSS score of EUVD-2026-13850?

EUVD-2026-13850 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Chargeportal are affected by EUVD-2026-13850?

CVE-2026-28204 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate EUVD-2026-13850?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Chargeportal EUVD-2026-13850

| CVE-2026-28204 MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-03-20 icscert

Information Disclosure Chargeportal Ctek

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 23:16 euvd

EUVD-2026-13850

Analysis Generated

Mar 20, 2026 - 23:16 vuln.today

CVE Published

Mar 20, 2026 - 22:47 nvd

MEDIUM 6.5

DescriptionCVE.org

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

AnalysisAI

Authentication identifiers for electric vehicle charging stations are publicly exposed through web-based mapping platforms, allowing unauthenticated network-based access to sensitive authentication data. The vulnerability affects CTEK ChargePortal and enables attackers to obtain charging station credentials without requiring any privileges or user interaction. This information disclosure can lead to unauthorized access to charging infrastructure and potential manipulation of charging sessions.

Technical ContextAI

The vulnerability stems from CWE-522 (Insufficiently Protected Credentials), where authentication identifiers that should remain confidential are inadvertently exposed through public-facing web-based mapping services. CTEK ChargePortal (cpe:2.3:a:ctek:chargeportal:*:*:*:*:*:*:*:*) is the affected product, which serves as a management and monitoring system for EV charging stations. The root cause involves improper credential storage or transmission mechanisms that allow these identifiers to be scraped, indexed, or otherwise harvested from mapping platforms without encryption or access controls. The mapping integration likely exposes station metadata including authentication tokens or credentials that should be restricted to authorized personnel only.

RemediationAI

Immediately contact CTEK support (https://www.ctek.com/support) to obtain and deploy the latest patched version of ChargePortal that implements proper credential protection and removes authentication identifiers from public mapping platform integration. As an interim measure, restrict the visibility of charging station metadata in any public-facing mapping services by disabling automated indexing, implementing authentication requirements for map access, and auditing current exposure through search engine caches and mapping platform APIs. Implement network segmentation to limit direct access to ChargePortal administration interfaces, enforce API authentication with strong tokens that are regularly rotated, and enable encryption for all credential storage. Review and revoke any authentication identifiers that may have been exposed through mapping platforms, and monitor charging station access logs for unauthorized connection attempts.