Etrel INCH EUVD-2026-116382

The management web interface must be network-reachable by the attacker and the factory-default administrator account must still be present/unchanged on the device (firmware prior to 7.1.2 or 8.0.1). Authentication occurs over cleartext HTTP, so no TLS or credential secrecy limits access. The primary limiting factor is operator hygiene: if the default credentials have been changed or the account disabled, or if the interface is not exposed to the attacker's network, exploitation fails. No user interaction, prior authentication, or non-default feature enablement is required - per PR:N the attacker is unauthenticated against a default-state device.

All available signals converge on genuine high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact to the vulnerable system (VC:H/VI:H/VA:H), scoring 9.3. The vuln.today decision label is act_now, the issue was reported by VulnCheck (a credible research source), and a vendor patch exists - all consistent with treating this as urgent. The weakness is hard-coded default credentials (CWE-1392): exploitation is trivial once the interface is reachable and the factory account is unchanged. Note the gaps: no EPSS probability is provided, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit code is indicated in the input, so there is no confirmation of active or widespread exploitation despite the high severity. Only a CVSS 4.0 vector is supplied (no 3.1 vector); the assessed 3.1 vector below is this analyst's own derivation. The act_now label combined with the simplicity of default-credential abuse justifies prioritized remediation even absent EPSS/KEV data.

An attacker locates an internet- or network-reachable Etrel INCH AC charging station management web interface and logs in over cleartext HTTP using the known factory-default administrator account, requiring no prior authentication. With full Administrator access they read the complete charger configuration and harvest the OCPP ChargePoint Identity and CSMS WebSocket connection details, gaining unauthorized administrative control of the charging station. No public exploit code is indicated in the input, but default-credential abuse requires no specialized tooling.