Is CVE-2026-112354 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-112354?

CVE-2026-112354 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-112354

Description

Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.