eCharge Hardy Barth cPH2 操作系统命令注入漏洞

eCharge Hardy Barth cPH2 is an electric vehicle charging station from eCharge. The eCharge Hardy Barth cPH2 suffers from an operating system command injection vulnerability that stems from the GET parameter in the index.php endpoint not being properly validated, which could lead to remote code...

CVE-2025-48417 Hard-Coded Certificate and Private Key for HTTPS Web Interface in eCharge Hardy Barth cPH2 / cPP2 charging stations

The certificate and private key used for providing transport layer security for connections to the web interface TCP port 443 is hard-coded in the firmware and are shipped with the update files. An attacker can use the private key to perform man-in-the-middle attacks against users of the admin...

CVE-2025-48417 Hard-Coded Certificate and Private Key for HTTPS Web Interface in eCharge Hardy Barth cPH2 / cPP2 charging stations

The certificate and private key used for providing transport layer security for connections to the web interface TCP port 443 is hard-coded in the firmware and are shipped with the update files. An attacker can use the private key to perform man-in-the-middle attacks against users of the admin...

CVE-2025-48417

The eCharge Hardy Barth cPH2 and cPP2 charging stations (version 2.2.0 ) are vulnerable to a man-in-the-middle attack due to hard-coded TLS certificates and private keys in the firmware. The keys, located in /etc/ssl (e.g., salia.local.key), are shipped with the update files, and the system lacks...

CVE-2025-48416 Backdoor Functionality via SSH in eCharge Hardy Barth cPH2 / cPP2 charging stations

An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the default SSH configuration the "PermitRootLogin" is disabled, preventing the root user from logging in via SSH. This configuration can be...

CVE-2025-48416 Backdoor Functionality via SSH in eCharge Hardy Barth cPH2 / cPP2 charging stations

An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the default SSH configuration the "PermitRootLogin" is disabled, preventing the root user from logging in via SSH. This configuration can be...

CVE-2025-48416

The eCharge Hardy Barth cPH2 and cPP2 charging stations (version 2.2.0 ) are affected by a vulnerability involving a hard-coded root user entry in the /etc/shadow file within the firmware image. While the default OpenSSH configuration disables PermitRootLogin , attackers can bypass or change this...

CVE-2025-48415

The eCharge Hardy Barth cPH2 and cPP2 electric vehicle charging stations (version 2.2.0 ) are affected by a USB backdoor feature. An attacker can trigger this backdoor by attaching a USB drive containing specially crafted salia.ini files. These files can contain commands that allow the attacker t...

CVE-2025-48415 Backdoor Functionality via USB Drive in eCharge Hardy Barth cPH2 / cPP2 charging stations

A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contain several "commands" that could be exploited by an attacker to export or modify the device configuration, enable an SSH backdoor or perform other...

CVE-2025-48414 Hard-coded web interface credentials in eCharge Hardy Barth cPH2 / cPP2 charging stations

There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to additional administrative/debug functionality and are likely intended for debugging during development and provides an additional attack surface...

CVE-2025-48413 Hard-coded OS root credentials in eCharge Hardy Barth cPH2 / cPP2 charging stations

The /etc/passwd and /etc/shadow files reveal hard-coded password hashes for the operating system "root" user. The credentials are shipped with the update files. There is no option for deleting or changing their passwords for an enduser. An attacker can use the credentials to log into the device...

CVE-2025-48413

The eCharge Hardy Barth cPH2 and cPP2 electric vehicle charging stations, specifically version 2.2.0 , are affected by hard-coded credentials. The /etc/passwd and /etc/shadow files contain hard-coded password hashes for the root user which are shipped with the update files. Because there is no op...

CVE-2025-48413 Hard-coded OS root credentials in eCharge Hardy Barth cPH2 / cPP2 charging stations

The /etc/passwd and /etc/shadow files reveal hard-coded password hashes for the operating system "root" user. The credentials are shipped with the update files. There is no option for deleting or changing their passwords for an enduser. An attacker can use the credentials to log into the device...

CVE-2025-27804 OS Command Injection Vulnerability in eCharge Hardy Barth cPH2 / cPP2 charging stations

Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions...

CVE-2025-27804

The eCharge Hardy Barth cPH2 and cPP2 electric vehicle charging stations (version 2.2.0 ) are vulnerable to multiple security flaws, including OS command injection. The root cause lies in the /var/salia/mqtt.php script within the device firmware, where publishing a specially crafted message to a ...

CVE-2025-27804 OS Command Injection Vulnerability in eCharge Hardy Barth cPH2 / cPP2 charging stations

Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions...

CVE-2025-27803

The eCharge Hardy Barth cPH2 and cPP2 charging stations (version 2.2.0 ) are vulnerable to a lack of authentication on their web interface and MQTT server . An attacker with network access can immediately gain administrative access , enabling them to perform arbitrary administrative actions, reco...

CVE-2025-27803 Missing Authentication in eCharge Hardy Barth cPH2 / cPP2 charging stations

The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets administrative access to the devices and can perform arbitrary administrative actions and reconfigure the devices or potentially gain access ...

CVE-2025-27803 Missing Authentication in eCharge Hardy Barth cPH2 / cPP2 charging stations

The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets administrative access to the devices and can perform arbitrary administrative actions and reconfigure the devices or potentially gain access ...

PT-2025-22342

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description The issue concerns hard-coded password hashes for the operating system "root" user, which are shipped with update files and cannot be deleted or changed by end-users. An attacker can use these...