Dashboard / CVE-2026-112354

CVE-2026-112354

CRITICAL
INFO Priority: 0.05 BB Relevance: 79/100
Published: 2026-11-03 Modified: 2026-11-12 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
Etrel d.o.o. Etrel INCH 0 < 7.1.2
Etrel d.o.o. Etrel INCH 8.0.0 < 8.0.1
Etrel d.o.o. Etrel INCH 0 < 7.1.2
Etrel d.o.o. Etrel INCH 8.0.0 < 8.0.1

References & Advisories (3)

Bug Bounty Relevance

79 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.54%
Raw Score 0.005400
Percentile 46.0%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00540
2026-11-13
0.00540
2026-11-12
0.00540
2026-11-10
0.00540
2026-11-09
0.00540
2026-11-08
0.00540
2026-11-07
0.00540
2026-11-06
0.00540
2026-11-05
0.00540
2026-11-04
0.00540

Intelligence Sources

mitre ref →
nvd ref →

External Links