CVE-2026-112354

{
  "etk_id": "ETK-2026-3412",
  "cve_id": "CVE-2026-112354",
  "display_id": "CVE-2026-112354",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-116382",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Hard-coded default credentials in Etrel INCH",
  "summary": "Etrel INCH charging-station management interfaces running firmware earlier than 7.1.2 or 8.0.1 use embedded factory credentials. A remote attacker who can reach the HTTP management interface can use that account to obtain administrator access and change or view charger configuration. Exposure requires network access to the affected device interface.",
  "mitigation": "Upgrade Etrel INCH devices to firmware 7.1.2 or 8.0.1, as appropriate for the release branch. Until upgraded, restrict access to the management HTTP interface to trusted administrative networks.",
  "vendor": "Etrel d.o.o.",
  "product": "Etrel INCH",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 7.1.2",
        ">= 8.0.0, < 8.0.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "7.1.2",
        "8.0.1"
      ],
      "package_name": "Etrel INCH",
      "purl": null
    }
  ],
  "cwes": [
    1392
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 59.94004533333333,
  "t0_at": "2026-11-03T21:05:28.673000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T21:05:28.673000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T21:05:28.673000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112354"
    }
  }
}