{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "cveMetadata": {
    "cveId": "CVE-2026-80279",
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "title": "Charger pin code retrievable with serial number",
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization bypass through User-Controlled key",
              "type": "CWE"
            }
          ]
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37: Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "affected": [
        {
          "vendor": "Elecq",
          "product": "Elecq Cloud Platform (API)",
          "versions": [
            {
              "status": "affected",
              "version": "-",
              "versionType": "date"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Due to missing authorization on Elecq’s cloud platform, the PIN code of a charging station could be retrieved based on its serial number. The issues were identified through coordinated testing by ElaadNL. There is no indication of exploitation in the wild prior to remediation. The affected Elecq Cloud Platform API has since been fixed in production for all users. The platform is operated by Elecq as a managed service and does not expose a public version number to customers.",
          "supportingMedia": [
            {
              "type": "text/html",
              "base64": false,
              "value": "<p>Due to missing authorization on Elecq’s cloud platform, the PIN code of a charging station could be retrieved based on its serial number. The issues were identified through coordinated testing by ElaadNL. There is no indication of exploitation in the wild prior to remediation. The affected Elecq Cloud Platform API has since been fixed in production for all users. The platform is operated by Elecq as a managed service and does not expose a public version number to customers.</p>"
            }
          ]
        }
      ],
      "tags": [
        "exclusively-hosted-service"
      ],
      "references": [
        {
          "url": "https://csirt.divd.nl/CVE-2026‑80279/",
          "tags": [
            "third-party-advisory"
          ]
        }
      ],
      "metrics": [
        {
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ],
          "cvssV4_0": {
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "vulnAvailabilityImpact": "NONE",
            "subAvailabilityImpact": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "valueDensity": "NOT_DEFINED",
            "vulnerabilityResponseEffort": "NOT_DEFINED",
            "providerUrgency": "NOT_DEFINED",
            "version": "4.0",
            "baseSeverity": "CRITICAL",
            "baseScore": 9.3,
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L"
          }
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Wilco van Beijnum (ElaadNL)",
          "type": "finder"
        },
        {
          "lang": "en",
          "value": "Victor Pasman (DIVD)",
          "type": "analyst"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  }
}