CVE-2026-31926

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31926", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-03-12T20:17:17.790Z", "datePublished": "2026-03-20T23:06:15.110Z", "dateUpdated": "2026-03-23T15:56:15.899Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-03-20T23:06:15.110Z"}, "title": "IGL-Technologies eParking.fi Insufficiently Protected Credentials", "datePublic": "2026-03-19T16:18:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-522", "description": "CWE-522", "type": "CWE"}]}], "affected": [{"vendor": "IGL-Technologies", "product": "eParking.fi", "versions": [{"status": "affected", "version": "All versions", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Charging station authentication identifiers are publicly accessible via web-based mapping platforms.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Charging station authentication identifiers are publicly accessible via web-based mapping platforms.<br>"}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "IGL-Technologies has updated eParking's OCPP servers to reduce the risks posed by the vulnerability. These updates implemented the following security controls: 1-Enforce modern security profiles and stronger authentication. 2-Device level whitelisting was implemented to ensure authorized devices connect. 3-Rate limiting controls prevent excessive requests and reduces denial-of-service attacks. 4-Enhanced automated monitoring and alerting to detection abnormal network activity.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>IGL-Technologies has updated eParking's OCPP servers to reduce the risks posed by the vulnerability. These updates implemented the following security controls: 1-</span>Enforce modern security profiles and stronger authentication. 2-Device level whitelisting was implemented to ensure authorized devices connect. 3-Rate limiting controls prevent excessive requests and reduces denial-of-service attacks. 4-Enhanced automated monitoring and alerting to detection abnormal network activity."}]}, {"lang": "en", "value": "Devices using the encrypted deployment of eParking's OCPP servers or \nIGL-Technologies proprietary eTolppa protocol are not impacted by these \nvulnerabilities.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Devices using the encrypted deployment of eParking's OCPP servers or \nIGL-Technologies proprietary eTolppa protocol are not impacted by these \nvulnerabilities."}]}, {"lang": "en", "value": "To prevent this in the future IGL-Technologies will continue \nvulnerability monitoring under their ISO\u202f27001:2022 security program and\n tighten security requirements for future third\u2011party OCPP hardware \napprovals.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "To prevent this in the future IGL-Technologies will continue \nvulnerability monitoring under their ISO\u202f27001:2022 security program and\n tighten security requirements for future third\u2011party OCPP hardware \napprovals."}]}, {"lang": "en", "value": "For more information please contact the IGL-Technologies security team at this email address: security@igl.fi.\n mailto:security@igl.fi", "supportingMedia": [{"type": "text/html", "base64": false, "value": "For more information please contact the IGL-Technologies security team at this email address: security@igl.fi.<br><a href=\"mailto:security@igl.fi\">mailto:security@igl.fi</a>"}]}], "credits": [{"lang": "en", "value": "Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA.", "type": "finder"}], "source": {"advisory": "ICSA-26-078-08", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-522", "lang": "en", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T14:50:34.900706Z", "id": "CVE-2026-31926", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:56:15.899Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31926", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T14:50:34.900706Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T14:50:47.785Z"}}], "cna": {"title": "IGL-Technologies eParking.fi Insufficiently Protected Credentials", "source": {"advisory": "ICSA-26-078-08", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "IGL-Technologies", "product": "eParking.fi", "versions": [{"status": "affected", "version": "All versions", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "IGL-Technologies has updated eParking's OCPP servers to reduce the risks posed by the vulnerability. These updates implemented the following security controls: 1-Enforce modern security profiles and stronger authentication. 2-Device level whitelisting was implemented to ensure authorized devices connect. 3-Rate limiting controls prevent excessive requests and reduces denial-of-service attacks. 4-Enhanced automated monitoring and alerting to detection abnormal network activity.", "supportingMedia": [{"type": "text/html", "value": "<span>IGL-Technologies has updated eParking's OCPP servers to reduce the risks posed by the vulnerability. These updates implemented the following security controls: 1-</span>Enforce modern security profiles and stronger authentication. 2-Device level whitelisting was implemented to ensure authorized devices connect. 3-Rate limiting controls prevent excessive requests and reduces denial-of-service attacks. 4-Enhanced automated monitoring and alerting to detection abnormal network activity.", "base64": false}]}, {"lang": "en", "value": "Devices using the encrypted deployment of eParking's OCPP servers or \nIGL-Technologies proprietary eTolppa protocol are not impacted by these \nvulnerabilities.", "supportingMedia": [{"type": "text/html", "value": "Devices using the encrypted deployment of eParking's OCPP servers or \nIGL-Technologies proprietary eTolppa protocol are not impacted by these \nvulnerabilities.", "base64": false}]}, {"lang": "en", "value": "To prevent this in the future IGL-Technologies will continue \nvulnerability monitoring under their ISO\u202f27001:2022 security program and\n tighten security requirements for future third\u2011party OCPP hardware \napprovals.", "supportingMedia": [{"type": "text/html", "value": "To prevent this in the future IGL-Technologies will continue \nvulnerability monitoring under their ISO\u202f27001:2022 security program and\n tighten security requirements for future third\u2011party OCPP hardware \napprovals.", "base64": false}]}, {"lang": "en", "value": "For more information please contact the IGL-Technologies security team at this email address: security@igl.fi.\n mailto:security@igl.fi", "supportingMedia": [{"type": "text/html", "value": "For more information please contact the IGL-Technologies security team at this email address: security@igl.fi.<br><a href=\"mailto:security@igl.fi\">mailto:security@igl.fi</a>", "base64": false}]}], "datePublic": "2026-03-19T16:18:00.000Z", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Charging station authentication identifiers are publicly accessible via web-based mapping platforms.", "supportingMedia": [{"type": "text/html", "value": "Charging station authentication identifiers are publicly accessible via web-based mapping platforms.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-03-20T23:06:15.110Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31926", "state": "PUBLISHED", "dateUpdated": "2026-03-23T15:56:15.899Z", "dateReserved": "2026-03-12T20:17:17.790Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-03-20T23:06:15.110Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "eParking.fi", "vendor": "IGL-Technologies", "versions": [{"status": "affected", "version": "All versions", "versionType": "custom"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Charging station authentication identifiers are publicly accessible via web-based mapping platforms."}, {"lang": "es", "value": "Los identificadores de autenticaci\u00f3n de las estaciones de carga son accesibles p\u00fablicamente a trav\u00e9s de plataformas de mapeo basadas en la web."}], "id": "CVE-2026-31926", "lastModified": "2026-06-17T10:34:46.310", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31926", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T14:50:34.900706Z", "version": "2.0.3"}}]}, "published": "2026-03-20T23:16:44.257", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-078-08.json"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-08"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "eParking.fi", "source": "cna", "vendor": "IGL-Technologies"}, "product": "eparking.fi", "vendor": "igl-technologies"}], "analysis": {"en": {"generated_at": "2026-03-21T07:01:38.272706+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2019s latest firmware and security update for eParking.fi OCPP servers.", "Verify that your deployment uses the encrypted server or the proprietary eTolppa protocol, which are immune to this vulnerability.", "Restrict public access to mapping platforms that expose charging\u2011station credentials, or implement authentication and authorization controls for those interfaces.", "Enable and review automated monitoring and alerting for anomalous network activity to detect potential credential abuse.", "Schedule regular vulnerability scans of your charging\u2011station infrastructure to ensure no undiscovered exposures remain."], "summary": {"action": "Apply Patch", "impact": "Credential Disclosure for Charging Stations"}, "threat_synthesis": {"affected_systems": "The affected product is the IGL\u2011Technologies eParking.fi OCPP server component. The risk applies to installations using the standard, unencrypted deployment of the servers; encrypted deployments or the proprietary eTolppa protocol are not impacted. No specific version range is supplied, but the advisory indicates that a recent proprietary patch has been issued to address the issue.", "description_and_impact": "A flaw exists in the IGL\u2011Technologies eParking.fi charging\u2011station software that allows authentication identifiers to be publicly visible through web\u2011based mapping platforms. This results in the disclosure of credentials which can enable unauthorized access to charging station functions, potentially leading to fraudulent usage, service disruption, or theft of charging data. The weakness is an example of insecure storage or transmission of credentials (CWE\u2011522).", "risk_and_exploitability": "The CVSS score of 6.9 indicates a moderate severity risk. While EPSS data is not provided and the vulnerability is not listed in the CISA KEV catalog, the publicly exposed credentials make exploitation relatively straightforward for an attacker who can discover the mapping platform. The likelihood of exploitation is inferred to be moderate, given that a publicly available credential object can be captured without authentication. The impact is primarily confidentiality breach of credentials, with secondary risks of availability and integrity if the compromised credentials are used to manipulate charging sessions."}}}}, "created": "2026-03-23T09:51:53.256316+00:00", "updated": "2026-03-25T14:33:52.662736+00:00", "vendors": ["igl-technologies", "igl-technologies$PRODUCT$eparking.fi"]}