{"id":"CVE-2026-112354","kind":"vulnerability","aliases":["CVE-2026-112354"],"related":[],"title":"Etrel INCH AC charger web panel ships with hard-coded admin login","description":"Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.","summary":"The Etrel INCH AC charging station web interface has a factory-default administrator account that cannot be changed. A remote attacker who logs in over plain HTTP gets full control of the charger, including its configuration and backend connection details.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["etrel","ev-charging","inch-ac","infrastructure","iot","ocpp"],"not_affected_if":["firmware-updated","not-exposed-to-network"],"how_to_check":"- Find the INCH AC chargers on the network and note their firmware version\n- Check whether the web management interface is reachable from outside the local network\n- Confirm whether the factory-default administrator login still works","fix":"- Move Etrel INCH AC chargers to firmware `7.1.2` or `8.0.1` or later","status":"open","published_at":"2026-11-03T22:17:44+00:00","first_seen_at":"2026-11-03T23:15:08+00:00","triaged_at":"2026-11-03T23:16:06+00:00","updated_at":"2026-11-03T23:16:06+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-03T23:16:06Z","model":"claude-haiku-5-5","output":{"fix":"- Move Etrel INCH AC chargers to firmware `7.1.2` or `8.0.1` or later","reach":"network","title":"Etrel INCH AC charger web panel ships with hard-coded admin login","impact":"high","summary":"The Etrel INCH AC charging station web interface has a factory-default administrator account that cannot be changed. A remote attacker who logs in over plain HTTP gets full control of the charger, including its configuration and backend connection details.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ev-charging","etrel","inch-ac","ocpp","iot"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker gains administrator control of the charging station and its backend connection details","analyst_note":"Confirm the firmware version boundary and whether the factory credentials are documented anywhere in the vendor advisory, via the VulnCheck advisory linked in the sources.","how_to_check":"- Find the INCH AC chargers on the network and note their firmware version\n- Check whether the web management interface is reachable from outside the local network\n- Confirm whether the factory-default administrator login still works","plain_action":"","needs_analyst":true,"not_affected_if":["firmware-updated","not-exposed-to-network"],"who_is_affected":"Operators of Etrel INCH AC charging stations running firmware before `7.1.2` or `8.0.1`, especially where the management web interface is reachable from the internet or from untrusted networks. Sites where the charger web interface is not exposed beyond a restricted network are at lower risk. Whether the factory credentials can be changed on a given unit is unknown.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000727,"input_tokens":4212,"output_tokens":612,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-112354':16A,19A '-2026':15A,18A '7.1.2':83C '8.0.1':85C 'ac':3A,26B,33B,73C 'access':102C 'account':44B,110C 'admin':12A 'administr':43B,101C,133C 'allow':95C 'attack':51B,97C,111C 'authent':104C 'backend':68B 'cannot':46B 'chang':48B 'charg':23B,34B,74C,137C 'chargepoint':124C 'charger':4A,63B,121C 'cleartext':116C 'code':11A,90C 'complet':120C 'configur':66B,122C 'connect':69B,129C 'contain':86C 'control':60B,134C 'credenti':92C 'csms':127C 'cve':14A,17A 'default':42B,91C,109C 'detail':70B,130C 'enabl':131C 'etrel':1A,20B,31B,71C 'ev':22B 'ev-charg':21B 'factori':41B,108C 'factory-default':40B,107C 'firmwar':81C 'full':59B,100C 'gain':99C 'get':58B 'hard':10A,89C 'hard-cod':9A,88C 'http':57B,117C 'ident':125C 'inch':2A,25B,32B,72C 'inch-ac':24B 'includ':64B 'infrastructur':27B 'interfac':37B,78C 'iot':28B 'log':53B,113C 'login':13A 'manag':76C 'obtain':119C 'ocpp':29B,123C 'panel':6A 'plain':56B 'prior':79C 'remot':50B,96C 'ship':7A 'station':35B,75C,138C 'unauthor':132C 'version':82C 'vulner':93C 'web':5A,36B,77C 'websocket':128C","nicknames":[],"mitigations":[],"who_affected":"Operators of Etrel INCH AC charging stations running firmware before `7.1.2` or `8.0.1`, especially where the management web interface is reachable from the internet or from untrusted networks. Sites where the charger web interface is not exposed beyond a restricted network are at lower risk. Whether the factory credentials can be changed on a given unit is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","etrel","evcharging","inchac","infrastructure","iot","ocpp"],"campaign_type":null,"first_public_at":"2026-11-03T22:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112354","severity":null,"published_at":"2026-11-03T22:17:44+00:00","modified_at":"2026-11-03T22:17:44+00:00","first_seen_at":"2026-11-03T23:15:08+00:00","fetched_at":"2026-11-03T23:15:08+00:00","note":null}],"documents":[{"id":61362,"url":"https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}