Vulnerability · Published May 21, 2025 · Assigned by SEC-VLab
CVE-2025-27803Missing Authentication in eCharge Hardy Barth cPH2 / cPP2 charging stations
Medium 6.5
In plain English
A medium-severity missing authentication in cPH2 / cPP2 charging stations from eCharge Hardy Barth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 60.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets administrative access to the devices and can perform arbitrary administrative actions and reconfigure the devices or potentially gain access to sensitive data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| eCharge Hardy Barth | cPH2 / cPP2 charging stations | <=2.2.0 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- https://r.sec-consult.com/echarge third-party-advisory
- http://seclists.org/fulldisclosure/2025/May/23