The vulnerability arises from hard‑coded default credentials in the Etrel INCH AC charging station’s web interface for firmware versions earlier than 7.1.2 (in the 7‑series) and 8.0.1 (in the 8‑series), allowing any remote user who can reach the device’s cleartext HTTP port to authenticate as the factory‑default administrator and gain full administrative control over the charger, including configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details.

The affected systems are Etrel d.o.o.’s Etrel INCH AC charging stations with firmware prior to 7.1.2 for the 7‑series and prior to 8.0.1 for the 8‑series; all devices running those firmware revisions are vulnerable.

The CVSS score of 9.3 classifies the flaw as critical, and the flaw can be exploited remotely over cleartext HTTP without requiring any special privileges; while no EPSS data is available, the absence of a CISA KEV listing does not mitigate the high likelihood of exploitation, and attackers can immediately gain unrestricted administrative access once the device is reachable over the network.