CVE-2026-112354

The record

Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.

Affected packages

Related vulnerabilities

• CVE-2026-22109 The shipped WebUI template database retains the factory default passwords for all five… CWE-1392
• CVE-2026-22105 Delta UFC500 charging stations derive the default credentials of the Service account from… CWE-1392
• CVE-2026-19741 Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default… CWE-1392
• CVE-2026-55457 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-1392
• CVE-2026-112296 FlyCms through commit edfdf724 contains a default credentials vulnerability that allows… CWE-1392
• CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials… CWE-1392
• CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official release has… CWE-1392
• CVE-2026-65313 A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering… CWE-1392