On this page (7 sections)
CVE-2026-112354 describes a hard-coded default credentials problem in the management web interface of Etrel INCH AC charging stations. According to the NVD record, a remote attacker can authenticate with the factory-default account and gain full Administrator access on firmware older than versions 7.1.2 and 8.0.1.
If you own, host or operate these chargers, for example at a business site, car park or fleet depot, you should find out which firmware they run and whether their web interface is reachable from outside your network. At the time of writing, only one independent publisher covers this story, so details beyond the CVE record are limited.
What happened
The NVD entry, published on 2026-11-03, says the charger's management web interface contains a hard-coded default credential. Anyone who can reach the interface and knows the factory-default account can sign in with full Administrator rights. The record also notes that the login can happen over cleartext HTTP, meaning traffic between the browser and the charger is not encrypted.
The references attached to the record include an Etrel INCH firmware page, the Etrel website and a VulnCheck advisory. The research available here contains only the NVD text, so check those pages directly for the vendor's exact upgrade instructions.
Why default credentials are so dangerous
Default credentials belong to the weakness class CWE-1392. A username and password built into every unit at the factory are effectively public once anyone learns them, and they cannot be rotated by one customer alone if the firmware does not allow it. No exploit skill is needed: the attacker just logs in. The risk grows when the interface is exposed to the internet or to a poorly segmented network.
Per the NVD description, a successful login exposes:
- The complete charger configuration.
- The OCPP ChargePoint Identity, the name the charger uses when it talks to its back-end system.
- CSMS WebSocket connection details, which describe how the charger connects to the charging station management system.
- Administrative control of the charging station.
The research does not say what an attacker could do with those connection details beyond the quoted wording, and it does not describe any real-world attacks. Treat any further impact claims as unconfirmed.
Who is affected
Affected are Etrel INCH AC charging stations running firmware prior to 7.1.2 and 8.0.1, where the management web interface can be reached by an attacker. The description does not spell out how the two version numbers map to firmware branches, so confirm with Etrel which release applies to your hardware. Exposure is highest for chargers whose web interface is reachable from the internet, or from shared networks such as guest Wi-Fi or a flat office LAN.
How to check your exposure
- Make a list of every Etrel INCH AC charger you operate, including those installed by contractors or tenants.
- Read the firmware version in the charger's management interface or your management platform, and compare it with 7.1.2 and 8.0.1.
- Find out whether the web interface is reachable from outside your network. Check router port forwards, cloud tunnels and firewall rules that point at the chargers.
- Ask your installer or Etrel whether the default account has been changed or disabled on your units.
If you manage a website or portal that sits in front of charging services, a read-only look from the outside can also show what you expose. The free security headers checker and the SSL certificate checker help review web-facing endpoints, though they cannot see inside a charger's private network.
What to do now
0 of 8 done
If you suspect a charger was accessed, treat the exposed data as compromised. Ask Etrel and your CSMS provider whether the ChargePoint Identity and connection settings should be changed, since the NVD record says these are revealed to anyone who logs in.
Detection and monitoring
The research gives no indicators of compromise, so there is no known log pattern to search for. Practical steps are to review access logs on any gateway or firewall in front of the chargers for unexpected HTTP requests to their management addresses, and to watch your CSMS for chargers that go offline, change identity or behave unexpectedly.
For public websites and portals that support your charging business, Webforta Monitor can track uptime, certificate and header changes, which helps you notice unplanned changes on the web side. It does not see or protect the chargers themselves. For broader hygiene on small organizations, see the small business website security guide.
What is still unknown
- No source in the research confirms active exploitation, and the CVE is not listed in CISA KEV.
- The exact default account name is not given in the research, and it is deliberately not repeated here.
- The exact firmware branch mapping for 7.1.2 and 8.0.1 should be confirmed with Etrel.
- Only one independent publisher covers this so far, so details may be refined as the vendor and others publish more.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.