CVE-2025-48417 Hard-Coded Certificate and Private Key for HTTPS Web Interface in eCharge Hardy Barth cPH2 / cPP2 charging stations
Hard-coded TLS private keys in eCharge Hardy Barth charging stations allow attackers to perform man-in-the-middle attacks against the admin interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-48417?
CVE-2025-48417 is a medium-severity vulnerability in eCharge Hardy Barth cPH2 / cPP2 charging stations, published on 21 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The certificate and private key used for providing transport layer security for connections to the web interface (TCP port 443) is hard-coded in the firmware and are shipped with the update files. An attacker can use the private key to perform man-in-the-middle attacks against users of the admin interface. The files are located in /etc/ssl (e.g. salia.local.crt, salia.local.key and salia.local.pem). There is no option to upload/configure custom TLS certificates.
Weakness: CWE-321
Which versions are affected by CVE-2025-48417?
How do I fix CVE-2025-48417?
No fix has been published for CVE-2025-48417 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-48417 being exploited?
There is no known exploitation of CVE-2025-48417 in the wild and no public exploit code.
Sources
Also known as GHSA-wxj8-443r-hmmr.