Critical severity9.8NVD Advisory· Published Nov 3, 2026

CVE-2026-112354

Description

Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Etrel/INCH AC charging station management web interfacellm-create
Range: <7.1.2, <8.0.1
Etrel/INCHllm-create
Range: <7.1.2, <8.0.1

Patches

Vulnerability mechanics

References

etrel.atlassian.net/wiki/spaces/EKC/pages/5064097853/Etrel+INCH+Firmwarenvd
etrel.comnvd
www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentialsnvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000