eCharge cPH2/cPP2 Charging Stations: Multiple Vulnerabilities (CVE-2025-27803, Command Injection, Backdoors, Hardcoded Credentials)

Critical Vulnerability Information Vulnerability Title Multiple Vulnerabilities in eCharge Hardy Barth cPH2 and cPP2 charging stations Vulnerability Details CVE IDs: CVE-2025-27803, CVE-2025-27804, CVE-2025-48414, CVE-2025-48415, CVE-2025-48416, CVE-2025-48417 Impact: Critical Affected Versions: 2.2.0 Discovery Date: 13.11.2023 Vulnerability Overview Missing Authentication (CVE-2025-27803): No authentication is implemented on the device's network interface and MQTT server. Multiple OS Command Injection Vulnerabilities (CVE-2025-27804): Multiple operating system command injection vulnerabilities exist. OS Backdoor User "root" (CVE-2025-48413): Hardcoded root user password disclosed. Backdoor Functionality via Web Interface (CVE-2025-48414): Scripts with hardcoded credentials exist in the web interface. Backdoor Functionality via USB Drive (CVE-2025-48415): Backdoor functionality can be triggered via USB drive. Backdoor Functionality via SSH (CVE-2025-48416): OpenSSH daemon listens on TCP port 22 with hardcoded login credentials. Hard-Coded Certificate and Private Key for HTTPS Web Interface (CVE-2025-48417): Certificate and private key for HTTPS web interface are hardcoded in the firmware. Mitigation Vendor has not provided any fixes yet. Workarounds No security device isolation available. Vendor Communication Timeline November 2023: Vulnerabilities discovered and reported to joint customers. January 2024: Contacted vendor. April 2024: Vendor confirmed new firmware to be released by end of April 2025. May 2025: Public security advisory released.

Goal Reached Thanks to every supporter — we hit 100%!

eCharge cPH2/cPP2 Charging Stations: Multiple Vulnerabilities (CVE-2025-27803, Command Injection, Backdoors, Hardcoded Credentials)