Undocumented Credential Vulnerability in Web Interface of a Popular Software Product
CVE-2025-48414

6.5MEDIUM

Key Information:

Vendor

Echarge Hardy Barth

Status
Cph2 / Cpp2 Charging Stations
Vendor
CVE Published:
21 May 2025

What is CVE-2025-48414?

This vulnerability involves the presence of several scripts within the web interface that can be accessed via undocumented hard-coded credentials. These scripts grant access to extended administrative and debugging functionalities likely designed for development purposes. This inadvertently broadens the attack surface, potentially allowing unauthorized users to exploit these scripts, posing significant security risks to the system.

Affected Version(s)

cPH2 / cPP2 charging stations <=2.2.0

References

https://r.sec-consult.com/echarge
third-party-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Stefan Viehböck | SEC Consult Vulnerability Lab
.