CVE-2025-48416 - Vulnerability Details - OpenCVE

An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the default SSH configuration the "PermitRootLogin" is disabled, preventing the root user from logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00066.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

Fixes

Solution

The vendor has not yet released a patch or communicated a timeline for firmware updates.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://r.sec-consult.com/echarge

History

Fri, 30 May 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 21 May 2025 12:30:00 +0000

Type	Values Removed	Values Added
Description		An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the default SSH configuration the "PermitRootLogin" is disabled, preventing the root user from logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though.
Title		Backdoor Functionality via SSH in eCharge Hardy Barth cPH2 / cPP2 charging stations
Weaknesses		CWE-912
References		https://r.sec-consult.com/echarge

MITRE

Status: PUBLISHED

Assigner: SEC-VLab

Published: 2025-05-21T12:15:02.694Z

Updated: 2025-05-30T16:25:51.046Z

Reserved: 2025-05-20T07:34:22.865Z

Link: CVE-2025-48416

Vulnrichment

Updated: 2025-05-30T16:23:35.526Z

NVD

Status : Awaiting Analysis

Published: 2025-05-21T13:16:02.947

Modified: 2025-05-30T17:15:29.400

Link: CVE-2025-48416

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-48416", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2025-05-20T07:34:22.865Z", "datePublished": "2025-05-21T12:15:02.694Z", "dateUpdated": "2025-05-30T16:25:51.046Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "cPH2 / cPP2 charging stations", "vendor": "eCharge Hardy Barth", "versions": [{"status": "affected", "version": "<=2.2.0"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Stefan Viehb\u00f6ck | SEC Consult Vulnerability Lab"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p><p></p><p></p><p></p><p></p><p>An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the \"/etc/shadow\" file in the firmware image for the \"root\" user. However, in the default SSH configuration the \"PermitRootLogin\" is disabled, preventing the root user from logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though.</p><p></p><p></p><p></p><p></p><p></p>"}], "value": "An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the \"/etc/shadow\" file in the firmware image for the \"root\" user. However, in the default SSH configuration the \"PermitRootLogin\" is disabled, preventing the root user from logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though."}], "impacts": [{"capecId": "CAPEC-176", "descriptions": [{"lang": "en", "value": "CAPEC-176 Configuration/Environment Manipulation"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-912", "description": "CWE-912 Hidden Functionality", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2025-05-21T12:15:02.694Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://r.sec-consult.com/echarge"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vendor has not yet released a patch or communicated a timeline for firmware updates.<br></p>"}], "value": "The vendor has not yet released a patch or communicated a timeline for firmware updates."}], "source": {"discovery": "EXTERNAL"}, "title": "Backdoor Functionality via SSH in eCharge Hardy Barth cPH2 / cPP2 charging stations", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-30T16:24:30.804367Z", "id": "CVE-2025-48416", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-30T16:25:51.046Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-48416", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-30T16:24:30.804367Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-30T16:23:35.526Z"}}], "cna": {"title": "Backdoor Functionality via SSH in eCharge Hardy Barth cPH2 / cPP2 charging stations", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Stefan Viehb\u00f6ck | SEC Consult Vulnerability Lab"}], "impacts": [{"capecId": "CAPEC-176", "descriptions": [{"lang": "en", "value": "CAPEC-176 Configuration/Environment Manipulation"}]}], "affected": [{"vendor": "eCharge Hardy Barth", "product": "cPH2 / cPP2 charging stations", "versions": [{"status": "affected", "version": "<=2.2.0"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "The vendor has not yet released a patch or communicated a timeline for firmware updates.", "supportingMedia": [{"type": "text/html", "value": "<p>The vendor has not yet released a patch or communicated a timeline for firmware updates.<br></p>", "base64": false}]}], "references": [{"url": "https://r.sec-consult.com/echarge", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the \"/etc/shadow\" file in the firmware image for the \"root\" user. However, in the default SSH configuration the \"PermitRootLogin\" is disabled, preventing the root user from logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though.", "supportingMedia": [{"type": "text/html", "value": "<p></p><p></p><p></p><p></p><p></p><p>An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the \"/etc/shadow\" file in the firmware image for the \"root\" user. However, in the default SSH configuration the \"PermitRootLogin\" is disabled, preventing the root user from logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though.</p><p></p><p></p><p></p><p></p><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-912", "description": "CWE-912 Hidden Functionality"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2025-05-21T12:15:02.694Z"}}}, "cveMetadata": {"cveId": "CVE-2025-48416", "state": "PUBLISHED", "dateUpdated": "2025-05-30T16:25:51.046Z", "dateReserved": "2025-05-20T07:34:22.865Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2025-05-21T12:15:02.694Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.1"}