PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-27777 Unknown Vendor CVE debrief

CVE-2026-27777 describes an information-disclosure issue in Mobiliti e-mobi.hu affecting charging-station authentication identifiers that are publicly accessible through web-based mapping platforms. CISA published the advisory on 2026-03-03 and notes Mobiliti did not respond to coordination requests. The exposed data is the primary concern; the advisory does not describe code execution or service disruption, but accessible authentication identifiers can still increase risk for charging infrastructure operators.

Vendor
Unknown Vendor
Product
Mobiliti e-mobi.hu vers:all/*
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-03
Original CVE updated
2026-03-03
Advisory published
2026-03-03
Advisory updated
2026-03-03

Who should care

Operators, administrators, and maintainers of Mobiliti / e-mobi.hu charging infrastructure; organizations that publish or integrate charging-station location data with web mapping platforms; defenders responsible for EV charging systems and adjacent web services.

Technical summary

The advisory states that charging station authentication identifiers are publicly accessible via web-based mapping platforms. The CVSS 3.1 vector provided is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, which aligns with a network-reachable disclosure issue with low complexity and no privileges required. The source material references CWE-522, suggesting improper protection of credentials or authentication material. No KEV listing is indicated in the supplied corpus.

Defensive priority

Moderate to high for exposed operators, because the issue is externally reachable and requires no privileges; prioritize systems where charging-station identifiers are published or aggregated online.

Recommended defensive actions

  • Inventory any Mobiliti / e-mobi.hu deployments and identify where charging-station authentication identifiers are stored, published, or mirrored.
  • Remove or restrict public access to identifiers in web-based mapping platforms and related APIs, and verify that only the minimum necessary metadata is exposed.
  • Review access controls, data publishing workflows, and account/identifier management for charging infrastructure.
  • Rotate or reissue any authentication identifiers if exposure could affect trust, account separation, or operational access.
  • Apply CISA-referenced ICS defensive practices and defense-in-depth guidance to the affected environment.
  • Monitor for unexpected access, scraping, or reuse of exposed identifiers.
  • Follow the vendor contact path referenced in the advisory if additional remediation guidance is needed.

Evidence notes

Primary evidence comes from CISA advisory ICSA-26-062-06 / CVE-2026-27777, published 2026-03-03, which states: "Charging station authentication identifiers are publicly accessible via web-based mapping platforms." The advisory lists CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, references CWE-522, and records that Mobiliti did not respond to CISA's coordination request. The supplied corpus does not indicate a KEV entry.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-27777 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-27777

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-27777 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-27777

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-062-06.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-06

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.