CVE-2026-112354

CRITICAL 9.8

Etrel INCH AC Charging Station Hard-coded Default Credentials

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.

CWE	CWE-1392
Vendor	etrel d.o.o.
Product	etrel inch
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for etrel d.o.o. etrel inch

Be the first to know when new critical vulnerabilities affecting etrel d.o.o. etrel inch are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Etrel d.o.o. / Etrel INCH

0 < 7.1.2 8.0.0 < 8.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

etrel.atlassian.net: https://etrel.atlassian.net/wiki/spaces/EKC/pages/5064097853/Etrel+INCH+Firmware etrel.com: https://etrel.com/ vulncheck.com: https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials

Credits

Nir Yehoshua (Force Majeure)