The alpitronic Hypercharger EV charger has been found vulnerable to remote exploitation due to its use of default credentials, a flaw cataloged as CVE-2024-4622. With a CVSS v4 score of 8.3, this vulnerability presents a significant risk, potentially allowing attackers to disable the device, bypass payment systems, or access sensitive payment data. The affected products include all versions of the Hypercharger EV charger, a widely deployed charging station utilized in transportation systems worldwide.
If misconfigured, the charging devices expose a web interface protected by default credentials. An attacker can exploit this by leveraging public knowledge to access the device as an administrator. alpitronic, the vendor, has responded by recommending immediate action for users to change default credentials and to restrict access to internal, segregated networks, mitigating the risk of exploitation. Additionally, alpitronic is implementing measures to ensure new devices come with unique passwords, automatically assigning new passwords to devices using default credentials.
CISA, in response to this vulnerability, recommends defensive measures to minimize the risk of exploitation, including network exposure reduction, firewall deployment, and the use of secure remote access methods like Virtual Private Networks (VPNs). Organizations are urged to perform impact analysis and risk assessments before implementing defensive measures. While no known public exploitation targeting this vulnerability has been reported, organizations are advised to remain vigilant and follow established procedures to report any suspected malicious activity to CISA.
Reference:
