If Mobility46 chargers are deployed at U.S. military installations, allied bases, or contractor logistics hubs, this vulnerability creates a denial-of-service vector against fleet electrification timelines that DoD and NATO have committed to. Adversary control of charging infrastructure can delay vehicle rotation, strand supply convoys, or create intelligence collection points on military movement patterns.
Swedish vendor compromise also triggers NATO supply-chain vetting—if Russia or China has pre-positioned exploit code in Mobility46 systems, this becomes a dormant sabotage asset in allied territory, forcing emergency infrastructure audits and potential replacement costs across multiple nations.
This affects charging infrastructure that underpins NATO ally logistics and U.S. military-adjacent supply chains (bases, contractor facilities, allied ports).
A CVSS 9.4 vulnerability with missing authentication is trivially exploitable and requires no user interaction—any networked Mobility46 unit is immediately compromisable without patching.
The advisory does not specify how many units are deployed or in which countries, which is the critical gap: if these chargers are embedded in allied critical infrastructure (particularly in Nordic countries, given the Swedish vendor), this becomes a supply-chain access vector for state actors.
If deployment is limited to commercial EV networks, the defense risk is lower but still material for military logistics corridors. The absence of vendor patch status or remediation timeline in the CISA notice is itself a red flag.
The advisory does not state: (1) how many Mobility46 units are deployed globally or in NATO/allied territory; (2) whether patches exist or timeline for availability; (3) which critical infrastructure or military-adjacent sites use these chargers; (4) whether any exploitation has been detected.
Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.