CVE-2025-27803

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets administrative access to the devices and can perform arbitrary administrative actions and reconfigure the devices or potentially gain access to sensitive data.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
eCharge Hardy BarthcPH2 / cPP2 charging stations<=2.2.0

References

Timeline

Published
May 21, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-278046.5Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially craftCVE-2025-278079.1An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380,CVE-2025-278095.4Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unlCVE-2025-27816.3The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default direcCVE-2025-278104.8Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory CVE-2025-278117.8A local privilege escalation in the razer_elevation_service.exe in Razer Synapse 4 through 4.0.86.2502180127 allows a local attacker to escaCVE-2025-278128.1MSI Center before 2.0.52.0 allows TOCTOU Local Privilege Escalation.CVE-2025-278138.1MSI Center before 2.0.52.0 has Missing PE Signature Validation.CVE-2025-278169.8A vulnerability was discovered in the Arctera InfoScale 7.0 through 8.0.2 where a .NET remoting endpoint can be exploited due to the insecurCVE-2025-278177.5A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration CVE-2025-278188.8A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or KafCVE-2025-278197.5In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not o