CVE-2025-48413 in cPH2 Charging Station
Summary
by MITRE • 05/21/2025
The `/etc/passwd` and `/etc/shadow` files reveal hard-coded password hashes for the operating system "root" user. The credentials are shipped with the update files. There is no option for deleting or changing their passwords for an enduser. An attacker can use the credentials to log into the device. Authentication can be performed via SSH backdoor or likely via physical access (UART shell).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/21/2025
This vulnerability represents a critical security flaw in embedded operating systems where default credentials are permanently embedded within system files. The presence of hard-coded password hashes in both /etc/passwd and /etc/shadow files creates a persistent backdoor that undermines fundamental security principles. These credentials are not only pre-configured but also shipped with update packages, making them impossible to remove or modify by end users. The vulnerability directly violates security best practices outlined in cwe-798 and cwe-259, as it exposes hardcoded authentication credentials that provide unrestricted access to system resources. The implications extend beyond simple credential exposure since these default accounts are typically configured with elevated privileges, enabling attackers to gain root-level access to the device. The attack surface is particularly concerning because authentication can be achieved through multiple vectors including ssh backdoor access and physical access via uart shell connections, providing attackers with flexible exploitation options.
The operational impact of this vulnerability is severe and far-reaching across multiple threat vectors. Attackers can leverage these hard-coded credentials to establish persistent access to affected systems without requiring any specialized knowledge or tools beyond basic authentication methods. The ssh backdoor capability means that remote exploitation is possible from any network location, while uart shell access provides physical access exploitation for devices that support serial console connections. This dual attack surface significantly increases the likelihood of successful compromise and makes the vulnerability particularly dangerous in environments where physical security controls may be inadequate. The inability for end users to modify or delete these credentials eliminates any user-controlled mitigation strategies, forcing organizations to rely entirely on vendor-provided patches or complete system replacement. This vulnerability aligns with attack techniques described in the attack tree framework where default credentials represent one of the most common initial access vectors for attackers.
Security professionals should recognize this vulnerability as a critical risk that requires immediate attention and mitigation. The lack of user control over these credentials makes it impossible to implement standard security practices such as password rotation or account management. Organizations must implement network segmentation and access controls to limit potential exploitation, while also ensuring that all affected systems receive immediate patches from vendors. The vulnerability demonstrates poor security design principles that should be addressed through proper credential management and secure configuration practices. Implementation of security controls such as disabling unused accounts, implementing strong access controls, and conducting regular security assessments can help mitigate the risk until permanent fixes are deployed. This type of vulnerability often indicates broader security design flaws within the system architecture that may expose additional attack vectors and requires comprehensive security audits to identify related weaknesses. The presence of such hard-coded credentials also violates industry standards including iso 27001 and nist cybersecurity framework requirements for secure system configuration and access control management.