CVE-2026-112354: Etrel INCH AC Charging Station Hard-coded Default Credentials

Published Nov 3, 2026

Updated

Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Etrel INCH AC charging station to a version that resolves this vulnerability.
Fixed in 7.1.2
Upgrade
Upgrade Etrel INCH AC charging station to a version that resolves this vulnerability.
Fixed in 8.0.1

Event History

Nov 3, 2026

CVE Published

via MITRE·09:05 PM

Data Sourced

via MITRE·09:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Etrel INCH AC charging stations running firmware earlier than 7.1.2 or 8.0.1 are affected. The vulnerable interface is the station management web interface.

What does an attacker need to exploit this issue?

An attacker needs network access to the charging station's management web interface. No existing account or user interaction is required because the factory-default account provides Administrator access.

Are default deployments at risk?

Yes. The issue is specifically caused by hard-coded factory-default credentials, which can be used to authenticate and obtain full Administrator access.

What could an attacker access after logging in?

An attacker can obtain complete charger configuration, the OCPP ChargePoint Identity, and CSMS WebSocket connection details. They can also exercise unauthorized administrative control of the charging station.

What should be prioritized for remediation?

Update affected stations to firmware 7.1.2 or 8.0.1 or later, as applicable. Until updated, restrict network access to the management web interface because authentication occurs over cleartext HTTP.

CVE-2026-112354: Etrel INCH AC Charging Station Hard-coded Default Credentials

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

Are default deployments at risk?

What could an attacker access after logging in?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

Are default deployments at risk?

What could an attacker access after logging in?

What should be prioritized for remediation?