A critical flaw in the Etrel INCH AC charging station's management web interface lets remote, unauthenticated attackers log in as Administrator using the factory-default account.
What Is It
CVE-2026-112354 is a hard-coded default credentials vulnerability (CWE-1392) in the management web interface of Etrel INCH AC charging stations. According to the NVD description, remote attackers can authenticate with the factory-default account and get full Administrator access. The login happens over cleartext HTTP. Once in, an attacker can retrieve the full charger configuration, the OCPP ChargePoint Identity, and the CSMS WebSocket connection details, which gives them unauthorized administrative control of the charging station.
VulnCheck reported the issue, and NVD published it on 2026-11-03. The NVD record is currently in "Received" status.
Why It Matters
VulnCheck rates this vulnerability CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and CVSS 4.0 9.3 (Critical). Exploitation needs network access only. It requires no privileges and no user interaction, and the impact to confidentiality, integrity and availability is high.
The exposed data matters beyond the device itself. The OCPP ChargePoint Identity and CSMS WebSocket connection details describe how the charger connects to its backend management system. Because the login runs over cleartext HTTP, credentials and session traffic can also be seen by anyone on the network path.
KEV status: CVE-2026-112354 is not in the supplied CISA KEV data. Active exploitation has not been confirmed by KEV at this time.
What's Vulnerable
- Vendor: Etrel d.o.o.
- Product: Etrel INCH (AC charging station management web interface)
- Affected versions:
- All firmware versions below 7.1.2
- Firmware 8.0.0 up to but not including 8.0.1
All other versions are listed as unaffected.
Patch Status
Based on the affected version ranges, fixes are available in Etrel INCH firmware 7.1.2 and 8.0.1. Operators should:
- Upgrade 7.x deployments to firmware 7.1.2 or later.
- Upgrade 8.x deployments to firmware 8.0.1 or later.
- Check Etrel's firmware page for release details.
Because the data exposed by this vulnerability includes OCPP identity and CSMS connection details, operators of chargers that were reachable while unpatched should treat that configuration data as potentially exposed. There is no CISA KEV required action, since the CVE is not in the supplied KEV data.