CVE-2026-112354Critical· 9.8▾ MidnightEtrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating w…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.
etrel_inch < 7.1.2etrel_inch >= 8.0.0 < 8.0.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94459High· 7.2IRISPowerscan Default accounts with predictable credentials
CVE-2026-22109High· 8.4Default WebUI passwords stored in plaintext
CVE-2026-22105High· 8.7Use of default password based on serial number
CVE-2026-44273Medium· 6.0Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability
CVE-2026-77056High· 7.1Use of Default Credentials in boneIO
CVE-2026-19741High· 7.5OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)