EV2GO's control of ~2,400 fast-charging stations across the US makes it a single point of failure for military vehicle logistics, particularly for the DoD's accelerating EV fleet transition. A sustained denial of service on the platform would force military motor pools back to slower Level 2 chargers or fuel-powered vehicles, compressing operational tempo during a contingency.
This vulnerability also creates a supply-chain espionage vector: an attacker impersonating a charging station could harvest geolocation and fleet composition data from DoD and contractor vehicles, yielding force-posture intelligence without traditional HUMINT.
This exposes a critical dependency in EV charging infrastructure that defense and civilian supply chains increasingly rely on.
EV2GO operates the largest public fast-charging network in the US; successful exploitation could disrupt logistics for military motor pools, contractor fleets, and civilian critical infrastructure. The vulnerabilities are pre-authentication, meaning no user credentials are required — the attack surface is the network itself.
Immediate patching is operationally urgent for any DoD facility or contractor using EV2GO; failure to patch before an adversary weaponizes these CVEs creates a denial-of-service vector against military mobility. The vendor's patch timeline and rollout speed will determine whether this remains a known-risk window or becomes an active threat.
The advisory does not specify whether patches are available, the patch timeline, or whether EV2GO has issued guidance to operators. We do not know if any of the four CVEs have been weaponized or if CISA has evidence of active exploitation in the wild.
Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.