Hard-Coded Default Credentials Vulnerability in Etrel INCH AC Charging Station Management Interface
CVE-2026-112354

9.3CRITICAL

Key Information:

Vendor

Etrel D.o.o.

Status
Etrel Inch
Vendor
CVE Published:
3 November 2026

What is CVE-2026-112354?

The Etrel INCH AC Charging Station management web interface prior to firmware versions 7.1.2 and 8.0.1 is susceptible to a hard-coded default credentials vulnerability. This issue permits remote attackers to authenticate using factory-default credentials, gaining unauthorized Administrator access. Once authenticated, an attacker can log in over unencrypted HTTP, allowing them to retrieve sensitive configurations, charge point identity, and WebSocket connection details, effectively taking control of the charging station’s operational settings.

Affected Version(s)

Etrel INCH 0 < 7.1.2

Etrel INCH 8.0.0 < 8.0.1

References

https://etrel.atlassian.net/wiki/spaces/EKC/pages/5064097...
productpatch
https://etrel.com/
product
https://www.vulncheck.com/advisories/etrel-inch-ac-chargi...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nir Yehoshua (Force Majeure)
.