CVE-2026-27773

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27773", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-02-23T23:48:14.364Z", "datePublished": "2026-02-27T00:03:43.458Z", "dateUpdated": "2026-03-05T20:46:14.581Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "swtchenergy.com", "vendor": "SWITCH EV", "versions": [{"status": "affected", "version": "All versions"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Charging station authentication identifiers are publicly accessible via web-based mapping platforms."}], "value": "Charging station authentication identifiers are publicly accessible via web-based mapping platforms."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-522", "description": "CWE-522", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-03-05T20:46:14.581Z"}, "references": [{"url": "https://swtchenergy.com/contact/"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-06"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-06.json"}], "source": {"advisory": "ICSA-26-057-06", "discovery": "EXTERNAL"}, "title": "SWITCH EV swtchenergy.com Insufficiently Protected Credentials", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SWITCH EV did not respond to CISA's request for coordination. Contact \nSWITCH EV using their contact page here: \n<a target=\"_blank\" rel=\"nofollow\" href=\"https://swtchenergy.com/contact/\">https://swtchenergy.com/contact/</a> for more information.\n\n<br>"}], "value": "SWITCH EV did not respond to CISA's request for coordination. Contact \nSWITCH EV using their contact page here: \n https://swtchenergy.com/contact/ for more information."}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T20:27:18.456089Z", "id": "CVE-2026-27773", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T20:27:26.902Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27773", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T20:27:18.456089Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T20:27:22.688Z"}}], "cna": {"title": "SWITCH EV swtchenergy.com Insufficiently Protected Credentials", "source": {"advisory": "ICSA-26-057-06", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SWITCH EV", "product": "swtchenergy.com", "versions": [{"status": "affected", "version": "All versions"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://swtchenergy.com/contact/"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-06"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-06.json"}], "workarounds": [{"lang": "en", "value": "SWITCH EV did not respond to CISA's request for coordination. Contact \nSWITCH EV using their contact page here: \n https://swtchenergy.com/contact/ for more information.", "supportingMedia": [{"type": "text/html", "value": "SWITCH EV did not respond to CISA's request for coordination. Contact \nSWITCH EV using their contact page here: \n<a target=\"_blank\" rel=\"nofollow\" href=\"https://swtchenergy.com/contact/\">https://swtchenergy.com/contact/</a> for more information.\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Charging station authentication identifiers are publicly accessible via web-based mapping platforms.", "supportingMedia": [{"type": "text/html", "value": "Charging station authentication identifiers are publicly accessible via web-based mapping platforms.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-03-05T20:46:14.581Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27773", "state": "PUBLISHED", "dateUpdated": "2026-03-05T20:46:14.581Z", "dateReserved": "2026-02-23T23:48:14.364Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-02-27T00:03:43.458Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "swtchenergy.com", "vendor": "SWITCH EV", "versions": [{"status": "affected", "version": "All versions"}]}], "source": "ics-cert@hq.dhs.gov"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:swtchenergy:swtchenergy.com:*:*:*:*:*:*:*:*", "matchCriteriaId": "5BD9A325-1924-47AF-9E3C-51FEF069A2B4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Charging station authentication identifiers are publicly accessible via web-based mapping platforms."}, {"lang": "es", "value": "Los identificadores de autenticaci\u00f3n de estaciones de carga son accesibles p\u00fablicamente a trav\u00e9s de plataformas de mapeo basadas en la web."}], "id": "CVE-2026-27773", "lastModified": "2026-06-17T10:27:40.030", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27773", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T20:27:18.456089Z", "version": "2.0.3"}}]}, "published": "2026-02-27T00:16:58.423", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory"], "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-06.json"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Product"], "url": "https://swtchenergy.com/contact/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-06"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "swtchenergy.com", "source": "cna", "vendor": "SWITCH EV"}, "product": "swtchenergy.com", "vendor": "switch_ev"}], "analysis": {"en": {"generated_at": "2026-04-17T14:08:43.627056+00:00", "value": {"mitigation_remediation": ["Secure the charging station authentication identifiers by removing them from all public web\u2011based mapping platforms and ensuring that any necessary data is stored behind authentication barriers.", "Replace exposed credentials with strong, unique values and enforce authentication mechanisms that do not reveal credentials in user\u2011facing services, following best practices for credential protection as outlined in CWE\u2011522.", "Contact SWITCH EV through their official support channels to request a security patch or fix, and consider implementing network segmentation to restrict management traffic to trusted networks until a vendor update is available."], "summary": {"action": "Assess Impact", "impact": "Unauthorized access via exposed charging station credentials"}, "threat_synthesis": {"affected_systems": "The affected vendor is SWITCH EV, specifically the swtchenergy.com platform that manages electric vehicle charging stations. All product versions linked to this vendor and product are potentially impacted, as no specific version details are provided. Therefore, any deployed devices or web services associated with this platform should be considered vulnerable until a vendor update or configuration change is applied.", "description_and_impact": "The vulnerability arises from insufficient protection of charging station authentication identifiers. These identifiers are publicly accessible through web\u2011based mapping platforms, enabling an attacker to view the credentials that grant access to individual stations. With the credentials in hand, an adversary could potentially gain unauthorized control over charging station operations, leading to service disruption or misuse of the station for illicit charging services. This weakness is classified under CWE\u2011522, which deals with insufficiently protected credentials.", "risk_and_exploitability": "The CVSS score of 6.9 indicates a moderate severity for the knowledge or possession of authentication identifiers. Exploitation is remote and may be achieved simply by accessing the public mapping platform, but the EPSS score is less than 1%, suggesting a low likelihood of real\u2011world exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, further indicating that no active exploits have been reported yet. Nonetheless, the attack vector is accessible over the internet and could enable an attacker to obtain credentials, which may cascade into unauthorized control of charging stations or denial of service if credentials are reused or stateful sessions are hijacked."}}}}, "created": "2026-02-27T09:03:21.839407+00:00", "updated": "2026-04-17T14:15:21.810836+00:00", "vendors": ["switch_ev", "switch_ev$PRODUCT$swtchenergy.com"]}