CVE-2025-27803 — Missing Authentication in eCharge Hardy Barth cPH2 / cPP2 charging stations

CVE-2025-27803

Missing Authentication in eCharge Hardy Barth cPH2 / cPP2 charging stations PUBLISHED

Description (CNA)

The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets administrative access to the devices and can perform arbitrary administrative actions and reconfigure the devices or potentially gain access to sensitive data.

Affected (CNA)

Vendor / product	Versions
eCharge Hardy Barth / cPH2 / cPP2 charging stations	affected <=2.2.0

CWE

CWE-306

References

https://r.sec-consult.com/echarge

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2025/May/23