What’s Vulnerable › Vulnerabilities
CVE-2025-7357: Plaintext Storage of a Password in LITEON IC48A and IC80A EV Chargers
- Severity: high (CVSS 8.7 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-07-16 · updated 2026-06-17
- Weakness: CWE-256
Description
LITEON IC48A firmware versions prior to 01.00.19r and LITEON IC80A firmware versions prior to 01.01.12e store FTP-server-access-credentials in cleartext in their system logs.
Affected products
- LITEON IC48A EV Charger: before 01.00.19r — fixed in 01.00.19r
- LITEON IC80A EV Charger: before 01.01.12e — fixed in 01.01.12e
How to fix
Upgrade to a fixed version: LITEON IC48A EV Charger 01.00.19r; LITEON IC80A EV Charger 01.01.12e. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-7357 or the next vulnerability affects your stack