What is the CVSS score of EUVD-2026-13857?

EUVD-2026-13857 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Eparking Fi are affected by EUVD-2026-13857?

CVE-2026-31926 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate EUVD-2026-13857?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Eparking Fi EUVD-2026-13857

| CVE-2026-31926 MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-03-20 icscert

Information Disclosure Eparking Fi Igl Technologies

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 23:16 euvd

EUVD-2026-13857

Analysis Generated

Mar 20, 2026 - 23:16 vuln.today

CVE Published

Mar 20, 2026 - 23:06 nvd

MEDIUM 6.5

DescriptionCVE.org

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

AnalysisAI

A web-based mapping platform exposes charging station authentication identifiers publicly, allowing unauthenticated network-based attackers to access sensitive credential information without any user interaction required. The vulnerability affects IGL Technologies eparking.fi application and enables attackers to obtain authentication material that could be leveraged for unauthorized access to charging infrastructure. There is no indication of active exploitation in the wild or public proof-of-concept code, but the vulnerability represents a direct exposure of authentication secrets (CWE-522) with moderate real-world impact.

Technical ContextAI

The vulnerability stems from improper protection of authentication credentials (CWE-522: Insufficiently Protected Credentials) within the IGL Technologies eparking.fi platform, specifically affecting how charging station identifiers and authentication material are exposed through web-based mapping interfaces. The root cause involves the storage or transmission of authentication credentials without adequate protection mechanisms, allowing enumeration and retrieval via HTTP/HTTPS requests over the network. The affected product is identified via CPE cpe:2.3:a:igl-technologies:eparking.fi:*:*:*:*:*:*:*:*, indicating all versions of the eparking.fi application are potentially vulnerable. This type of exposure typically occurs when sensitive identifiers are embedded in client-side code, API responses, or database records that are accessible through unauthenticated endpoints or public web mapping services.

RemediationAI

Coordinate with IGL Technologies to obtain and deploy the patched version of eparking.fi addressing the credential exposure; refer to the CISA advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08 for specific patched version numbers and deployment instructions. Immediate mitigating controls should include: (1) removing authentication identifiers from all web-based mapping platforms and public-facing interfaces, ensuring these are restricted to authenticated endpoints only; (2) implementing network-level access controls to restrict mapping service access to authorized users and IP ranges; (3) rotating any authentication credentials that may have been exposed to attackers; and (4) implementing enhanced monitoring and logging on charging station infrastructure to detect unauthorized access attempts. Organizations should prioritize credential rotation and access restriction as immediate interim measures while awaiting patched versions.