CVE-2026-28204 PUBLISHED

CTEK Chargeportal Insufficiently Protected Credentials

Assigner: icscert
Reserved: 12.03.2026 Published: 20.03.2026 Updated: 20.03.2026

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor CTEK
Product Chargeportal
Versions Default: unaffected
  • Version All versions is affected

Workarounds

CTEK will be sunsetting this product in April 2026. Please contact CTEK for more information  https://www.ctek.com/support .

Credits

  • Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA. finder

References

Problem Types

  • CWE-522 CWE