CVE-2025-48417 in cPH2 Charging Station
Summary
by MITRE • 05/21/2025
The certificate and private key used for providing transport layer security for connections to the web interface (TCP port 443) is hard-coded in the firmware and are shipped with the update files. An attacker can use the private key to perform man-in-the-middle attacks against users of the admin interface. The files are located in /etc/ssl (e.g. salia.local.crt, salia.local.key and salia.local.pem). There is no option to upload/configure custom TLS certificates.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/21/2025
This vulnerability represents a critical security flaw in the firmware of network devices that utilize hardcoded TLS certificates for their web interfaces. The issue stems from the inclusion of identical certificate and private key files within the firmware images and update packages, creating a persistent security risk across all affected deployments. The hardcoded credentials are stored in the /etc/ssl directory with filenames such as salia.local.crt, salia.local.key, and salia.local.pem, making them easily identifiable and exploitable by malicious actors who gain access to the firmware or update mechanisms.
The technical implementation of this flaw violates fundamental security principles by embedding cryptographic materials directly into the firmware rather than generating unique certificates per device during deployment. This design choice creates a scenario where a single compromised private key can compromise all devices running the affected firmware versions. The vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information) and CWE-326 (Inadequate Encryption Strength) as it stores sensitive cryptographic material in cleartext format within the firmware and provides no mechanism for device-specific certificate generation or management. The absence of custom certificate upload capabilities forces administrators to accept the hardcoded credentials, eliminating any possibility of implementing proper certificate lifecycle management.
The operational impact of this vulnerability is severe and far-reaching, as it enables sophisticated man-in-the-middle attacks against administrators accessing the web interface via TCP port 443. Attackers who can intercept network traffic or gain access to the firmware update process can leverage the hardcoded private key to decrypt communications, impersonate legitimate web servers, and potentially escalate privileges within the device management interface. This vulnerability directly maps to attack techniques described in the MITRE ATT&CK framework under T1566 (Phishing for Information) and T1041 (Exfiltration Over C2 Channel) as attackers can use the compromised credentials to establish persistent access to device management interfaces. The risk is amplified by the fact that these credentials are shipped with update files, meaning that any device that receives an update package becomes vulnerable regardless of the device's initial security posture.
Organizations affected by this vulnerability must implement immediate mitigations to protect their network infrastructure. The primary recommendation involves disabling access to the web interface when possible, implementing network segmentation to isolate management traffic, and establishing monitoring for unauthorized firmware updates. Administrators should also consider implementing network-based intrusion detection systems to monitor for unusual traffic patterns that might indicate exploitation attempts. The long-term solution requires device vendors to provide firmware updates that implement proper certificate generation mechanisms and allow for custom TLS certificate configuration. This vulnerability highlights the critical importance of following security best practices such as those outlined in NIST SP 800-53 and ISO/IEC 27001, which emphasize the need for unique cryptographic identifiers and proper certificate management procedures. Without these updates, affected devices remain permanently vulnerable to attacks that can compromise entire network infrastructures through manipulation of the web-based management interface.