cPH2 / cPP2 charging stations vulnerabilities

2 known vulnerabilities in cPH2 / cPP2 charging stations from eCharge Hardy Barth. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  cPH2 / cPP2 charging stations: Hidden Functionality

  CVE-2025-48416May 21, 2025eCharge Hardy Barth

  An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the default SSH configuration the "PermitRootLogin" is disabled, preventing the root user from logging in via

• 7.7 High severity

  cPH2 / cPP2 charging stations: Use of Hard-coded Credentials

  CVE-2025-48413May 21, 2025eCharge Hardy Barth

  The `/etc/passwd` and `/etc/shadow` files reveal hard-coded password hashes for the operating system "root" user. The credentials are shipped with the update files. There is no option for deleting or changing their passwords for an enduser. An attacker can use