Vulnerability · Published May 21, 2025 · Assigned by SEC-VLab

CVE-2025-48417Hard-Coded Certificate and Private Key for HTTPS Web Interface in eCharge Hardy Barth cPH2 / cPP2 charging stations

Medium 6.5

In plain English

A medium-severity security flaw in cPH2 / cPP2 charging stations from eCharge Hardy Barth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 87.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The certificate and private key used for providing transport layer security for connections to the web interface (TCP port 443) is hard-coded in the firmware and are shipped with the update files. An attacker can use the private key to perform man-in-the-middle attacks against users of the admin interface. The files are located in /etc/ssl (e.g. salia.local.crt, salia.local.key and salia.local.pem). There is no option to upload/configure custom TLS certificates.

Affected products (as reported)

Vendor	Product	Versions
eCharge Hardy Barth	cPH2 / cPP2 charging stations	<=2.2.0

Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://r.sec-consult.com/echarge third-party-advisory
http://seclists.org/fulldisclosure/2025/May/23