CVE-2025-27804: Echarge Hardy Barth CPH2 / CPP2 Charging Stations

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions.

Affected products

• Echarge Hardy Barth CPH2 / CPP2 Charging Stations: up to and including 2.2.0

Published 2025-05-21. Last modified 2026-06-17.