Vulnerability in Echarge Hardy Barth Cph2 / Cpp2 Charging Stations
CVE-2025-48413
The `/etc/passwd` and `/etc/shadow` files reveal hard-coded password hashes for the operating system "root" user. The credentials are shipped with the update files. There is no option for deleting or changing their passwords for an enduser. An attacker can use the credentials to log into the device. Authentication can be performed via SSH backdoor or likely via physical access (UART shell).
EPSS: 0.002 (12.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Echarge Hardy Barth Cph2 / Cpp2 Charging Stations — versions <=2.2.0
Weakness classification (CWE)
References
- 551230f0-3615-47bd-b7cc-93e92e730bbf (third-party-advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-48413?
- CVE-2025-48413 is a high-severity vulnerability in Echarge Hardy Barth Cph2 / Cpp2 Charging Stations, classified under Use of Hard-coded Credentials. CVSS score: 7.7/10. Published 2025-05-21.
- How severe is CVE-2025-48413?
- High severity. CVSS v3 base score is 7.7 out of 10.