---
id: CVE-2026-112354
title: Etrel INCH AC Charging Station Hard-coded Default Credentials
summary: >-
  Etrel INCH AC charging station management web interface prior to firmware
  versions 7.1.2 and 8.0.1 contains a hard-coded default credentials
  vulnerability that allows remote attackers to gain full Administrator access
  by authenticating w…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-1392
vendor: Etrel d.o.o.
product: Etrel INCH
affected:
  - etrel_inch < 7.1.2
  - etrel_inch >= 8.0.0 < 8.0.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-07T03:35:46.880664Z'
published: '2026-11-03'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T03:35:57.049Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112354'
references:
  - url: >-
      https://etrel.atlassian.net/wiki/spaces/EKC/pages/5064097853/Etrel+INCH+Firmware
    label: Firmware Download
  - url: 'https://etrel.com/'
    label: Vendor Homepage
  - url: >-
      https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials
    label: >-
      VulnCheck Advisory: Etrel INCH AC Charging Station Hard-coded Default
      Credentials
tags:
  - cve.org
epss: 0.0054
epssPercentile: 0.45605
ingestedAt: '2026-11-05T20:33:06.480Z'
---

## Overview

Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.

## Affected

- `etrel_inch < 7.1.2`
- `etrel_inch >= 8.0.0 < 8.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.