Horizon Alert
Summary of the vulnerability and why it matters
This CVE affects the web interface of Etrel INCH AC charging station management systems, specifically those running prior to certain firmware versions. A vulnerability exists where hard-coded default credentials allow remote attackers to gain full administrative access, potentially exposing sensitive configuration data and enabling unauthorized control of the charging station. The main concern is confirming relevance and exposure to these specific charging stations.
- Weak credentials grant full station control.
- Critical for managing charging infrastructure.
- Confirm exposure; assess potential impacts.
Attack Path
How an attacker could exploit the issue
An attacker can remotely access the web interface of the Etrel INCH AC charging station over an unencrypted HTTP connection. By using hard-coded default credentials, they can log in as an administrator, gaining full control over the charging station's configuration and operational details. This access can then be leveraged for unauthorized administrative actions.
- Remote, unauthenticated network access required.
- Log in with default administrator credentials.
- Full administrative control of charging station.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow remote attackers to gain full administrative access to an Etrel INCH AC charging station by using hard-coded default credentials over cleartext HTTP. This could expose sensitive configuration data, including OCPP ChargePoint identity and CSMS WebSocket connection details, leading to unauthorized control of the charging station.
- Charging station configuration and identity data.
- Gained via unauthenticated HTTP requests.
- Unauthorized administrative control of the station.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Etrel INCH AC charging station management interface is vulnerable to hard-coded default credentials, allowing remote attackers full administrator access. This risk likely falls to the Infrastructure or Platform team responsible for managing the charging station hardware and its core functionality, or potentially a Vendor Management team if the stations are managed by a third party. The immediate priority is to inventory all deployed charging stations, confirm their network exposure and business criticality, and identify the accountable owner for remediation planning.
- Infrastructure or Platform teams own the issue.
- Verify network exposure and criticality of stations.
- Plan risk-based remediation with the vendor.
