CVE-2026-112354

Summary

The Etrel INCH AC charging station web interface uses hard-coded default credentials that allow unauthenticated remote attackers to log in as Administrator over HTTP, granting full control over the charger.

Exploitability

Trivial to exploit; no authentication or user interaction required—attackers only need network access to the management interface.

Blast radius

Successful exploitation grants complete administrative control, enabling theft of OCPP and CSMS credentials, configuration tampering, and potential disruption or misuse of EV charging infrastructure.

Detection

Look for repeated failed or successful login attempts to the /login endpoint over HTTP from external IP addresses, especially with default username/password combinations like 'admin/admin' or 'root/root'.

Prioritized remediation

Upgrade to firmware version 7.1.2 or 8.0.1 or later; until then, disable HTTP access and enforce HTTPS-only management with strong credential rotation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.