CVE-2025-48416CWE-912

Backdoor Functionality via SSH in eCharge Hardy Barth cPH2 / cPP2 charging stations

High · published May 21, 2025

CVSS v3.1
8.1
EPSS
1%
Percentile
46.4
In the wild
Unconfirmed
What it is

An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the default SSH configuration the "PermitRootLogin" is disabled, preventing the root user from logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00570 · 46.4th percentile
Weakness
CWE-912 · Hidden Functionality
Published
2025-05-21T12:15Z
EPSS history
Timeline
  • 21 MAY 12:15Z
    Backdoor Functionality via SSH in eCharge Hardy Barth cPH2 / cPP2 charging stations
    cvelistv5