eCharge Hardy Barth Charging Stations OS Backdoor Vulnerability

A backdoor vulnerability has been identified in eCharge Hardy Barth cPH2 and cPP2 charging stations running firmware version 2.2.0. The vulnerability arises from hard-coded password hashes for the 'root' user, which are included in the update files. This allows an attacker to gain unauthorized access to the device, potentially through an SSH backdoor or physical access via a UART shell.

Impact

Exploitation of this vulnerability allows for unauthorized access to the device with root privileges, enabling an attacker to execute arbitrary commands, access sensitive data, and manipulate the device's configuration. This backdoor access can disrupt operations and compromise the security of the EV charging infrastructure.