CVE-2026-112354

Name of the Vulnerable Software and Affected Versions Etrel INCH versions prior to 7.1.2 Etrel INCH versions prior to 8.0.1

Description The management web interface contains hard-coded default credentials. Remote attackers can authenticate using the factory-default account via cleartext HTTP to gain full Administrator access. This allows unauthorized administrative control of the charging station and the ability to obtain the complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details.

Recommendations Update to version 7.1.2. Update to version 8.0.1.