Etrel INCH AC: Management web interface default credentials (CVE-2026-112354)
Etrel INCH AC charging station management web interface contains a hard-coded default credentials vulnerability.
CVE search metadata
CVE search record: CVE-2026-112354. Severity: critical. CVSS: 9.8. KEV: no. Product: INCH AC. Brief: Etrel INCH AC: Management web interface default credentials (CVE-2026-112354). Brief link: https://feed.craftedsignal.io/briefs/2026-11-etrel-inch-ac-default-credentials/
Triage facts
Revision 2- Applicability
- INCH AC
- Evidence
- Not observed
- Severity
- Critical
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 4, 00:47 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.