Etrel INCH charger web panel has hard-coded default admin login
Anyone can log into the charger's management page with the default account and control it!
Summary
The web management interface of Etrel INCH AC charging stations has a factory default account built in, so a remote attacker can log in as Administrator. Charger configuration and charging server connection details are also exposed, allowing unauthorized control of the charger.
What to do
Update firmware to 7.1.2 for versions below 8.0.0, and to 8.0.1 for the 8.0.0 line. See the vendor's guidance for details.
Update to at least the version for your product:
- Etrel INCH below 8.0.0 7.1.2 or later
- Etrel INCH 8.0.0 8.0.1 or later
Update these devices now!
- Etrel INCH AC
Fixed in version 7.1.2.
Products and platforms
CVE IDs
Sources
- Write-up: vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen