Backdoor Functionality via SSH in eCharge Hardy Barth cPH2 / cPP2 charging stations
Vulnerability Description
An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the default SSH configuration the "PermitRootLogin" is disabled, preventing the root user from logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-48416
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Stefan Viehböck | SEC Consult Vulnerability Lab
References
More from eCharge Hardy Barth
View All →Affected Vendor
eCharge Hardy Barth
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.