eCharge Hardy Barth SSH Backdoor Vulnerability Allowing Root Access

A backdoor vulnerability has been identified in eCharge Hardy Barth cPH2 and cPP2 charging stations, specifically in firmware version 2.2.0. The issue arises from a hard-coded entry for the 'root' user in the '/etc/shadow' file, which is included in the firmware image. Although the default SSH configuration disables root login, this restriction can be bypassed by an attacker through various methods.

Impact

Exploitation of this vulnerability allows unauthorized access to the root account via SSH, enabling an attacker to execute commands with root privileges on the affected device.

Reproduction

The vulnerability can be reproduced by accessing the device via SSH on TCP port 22. Despite the 'PermitRootLogin' setting being disabled by default, this configuration can be changed or bypassed, allowing root access.