Hard-coded default credentials in Etrel INCH AC charging station
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Etrel INCH AC charging station management web interface before 7.1.2 and from 8.0.0 before 8.0.1 contains hard-coded default credentials (CWE-1392). A remote attacker can log in with the factory-default account over cleartext HTTP and gain full Administrator access. The attacker can then read the complete charger configuration, the OCPP ChargePoint Identity and the CSMS WebSocket connection details, and control the charging station.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Etrel d.o.o. | Etrel INCH | before 7.1.2; 8.0.0 to before 8.0.1 | 7.1.2, 8.0.1 | Patch available | CNA |
- Etrel INCH VendorEtrel d.o.o. Affected before 7.1.2; 8.0.0 to before 8.0.1 Fixed in 7.1.2, 8.0.1 Patch available CNA
Remediation
Upgrade Etrel INCH to version 7.1.2 or 8.0.1, which fix this issue. The sources list no advisory identifier for the fix.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA Etrel INCH (Etrel d.o.o.) Fixed in 7.1.2, 8.0.1
Timeline
- 2026-11-03 Threatist record created from CVE-2026-112354
- 2026-11-04 Alias added: GHSA-mrqf-rmrx-7g23
- 2026-11-07 CISA SSVC decision points changed
References
Patch 1
Other 1
Sources
- CVE-2026-112354 · CVE Program
- CVE-2026-112354 · NVD
- FIRST EPSS
- GHSA-mrqf-rmrx-7g23 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences