PT-2025-22346 · Echarge Hardy Barth · Cph2 / Cpp2 Charging Stations

Published 2025-05-21 · Updated 2025-05-21 · CVE-2025-48417

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The product name cannot be determined.

Description The issue concerns hard-coded TLS certificates and private keys in the firmware for the web interface, specifically on TCP port 443. An attacker can exploit this by using the private key to perform man-in-the-middle attacks against users of the admin interface. The affected files are located in /etc/ssl, including salia.local.crt, salia.local.key, and salia.local.pem. There is no option to configure custom TLS certificates, making the system vulnerable to such attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2025-48417

Affected Products

Cph2 / Cpp2 Charging Stations

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-48417 · Security Note
• https://t.me/cvetracker/24372 · Telegram Post
• https://r.sec-consult.com/echarge · Note
• http://seclists.org/fulldisclosure/2025/May/23 · Note
• https://twitter.com/CVEnew/status/1925185825936986441 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1925207105356620208 · Twitter Post