[ CVE-2026-112354 · Published 3 Nov 2026 ]
Vulnerability in Etrel d.o.o. Etrel INCH
CVSS 9.8
EPSS <1%No fix listed yet
[ Why it matters ]Priority signals
- Critical severity: CVSS 9.8
[ Description ]Official description
Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.