Live › vulnerability › CVE-2026-112354
The Etrel INCH AC charging station web interface has a factory-default administrator account that cannot be changed. A remote attacker who logs in over plain HTTP gets full control of the charger, including its configuration and backend connection details.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:15 UTC. All times on this page are UTC.
Operators of Etrel INCH AC charging stations running firmware before 7.1.2 or 8.0.1, especially where the management web interface is reachable from the internet or from untrusted networks. Sites where the charger web interface is not exposed beyond a restricted network are at lower risk. Whether the factory credentials can be changed on a given unit is unknown.
No product ranges from the sources yet.
7.1.2 or 8.0.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.
This page as .md · .json · in your agent: get_signal("CVE-2026-112354")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.