CVE-2024-4622: alpitronic Hypercharger EV Charger Default-Credential Web Interface Exposure

CVE-2024-4622 is a default-credentials exposure (CWE-1392) in alpitronic's Hypercharger, a high-power public EV fast-charging station: if an operator leaves a misconfigured unit's administrative web interface on its factory-default login, an attacker on the network can use publicly known default credentials to log in as administrator and potentially disable the charger, bypass payment, or access payment data, and NVD has not, as of 2026-11-08, published its own Primary CVSS score for the flaw.

CVE-2024-4622 (CWE-1392, use of default credentials) affects alpitronic's Hypercharger line of DC fast-charging stations for electric vehicles. NVD's description states: "If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication. If the default credentials are not changed, an attacker can use public knowledge to access the device as an administrator" (NVD).

NVD tracks CVE-2024-4622 with status "Deferred": it records only a CISA ICS-CERT-submitted Secondary rating — CVSS v4.0 8.3 (high), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N — so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD).

CISA's advisory ICSA-24-130-02 credits security researcher Hanno Böck with reporting the issue, places the Hypercharger in the Transportation Systems sector with worldwide deployment, and states: "Successful exploitation of this vulnerability could result in an attacker disabling the device, bypassing payment, or accessing payment data" (CISA ICS Advisory ICSA-24-130-02).

CISA's recommended mitigations are to change the default credentials on all charging devices, minimize network exposure for control-system devices so they are not reachable from the internet, place control-system networks and remote devices behind firewalls isolated from business networks, and connect the administrative interface only to an internal, segregated, access-controlled network (CISA ICS Advisory ICSA-24-130-02).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00489 (42.3th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, operators of Hypercharger EV charging stations should confirm the administrative web interface's default credentials have been changed and that the interface is not reachable from the public internet or an unsegregated network.

• If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication; if default credentials are not changed, an attacker can use public knowledge to access the device as an administrator (CWE-1392). — NVD
• NVD status is 'Deferred' with a CISA ICS-CERT-submitted Secondary CVSS v4.0 8.3; no NVD-published Primary score. — NVD
• Reported by Hanno Böck; affects the Transportation Systems sector worldwide; 'Successful exploitation of this vulnerability could result in an attacker disabling the device, bypassing payment, or accessing payment data.' Mitigations: change default credentials, minimize network exposure, use firewalls, restrict the interface to internal segregated networks. — CISA ICS Advisory ICSA-24-130-02
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00489 (42.3th percentile) as of 2026-11-07. — FIRST EPSS