LITEON EV chargers leak FTP credentials in plaintext logs
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
LITEON IC48A and IC80A EV chargers store FTP credentials in cleartext; remotely exploitable for credential disclosure.
LITEON IC48A firmware versions prior to 01.00.19r and IC80A firmware versions prior to 01.01.12e contain a plaintext storage vulnerability (CVE-2025-7357, CWE-256) where FTP-server-access-credentials are exposed in system logs. The vulnerability is remotely exploitable with low attack complexity and no authentication required, earning a CVSS v4 score of 8.7. Successful exploitation allows attackers to extract sensitive credentials for accessing the chargers' FTP interfaces.
LITEON has released patched firmware: IC48A version 01.00.20h and IC80A version 01.01.13m. The chargers are deployed worldwide across commercial facilities, energy, and transportation sectors. CISA reports no known public exploitation to date. Defenders should prioritize network segmentation—isolating charger infrastructure from direct internet access, deploying behind firewalls, and requiring VPN for remote access—while applying available firmware updates.
Mentioned in this report
Detection guidance
Linux Grep of System Logs for FTP Credentials
Detects grep-style tools searching /var/log for FTP and password/credential strings, which matches hunting for plaintext FTP credentials leaked into logs (CVE-2025-7357 pattern). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux Grep of System Logs for FTP Credentials
description: Detects grep/zgrep/egrep/awk/sed run against /var/log content with both
an FTP keyword and a password/credential keyword. This matches harvesting of plaintext
FTP credentials leaked into system logs, as in the LITEON charger CVE-2025-7357
pattern. Generalises on the tool plus log path plus credential keywords, not on
any specific log file name.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith:
- /grep
- /egrep
- /fgrep
- /zgrep
- /awk
- /sed
selection_path:
CommandLine|contains: /var/log
selection_ftp:
CommandLine|contains: ftp
selection_cred:
CommandLine|contains:
- passw
- pwd
- credential
condition: all of selection_*
falsepositives:
- Administrators troubleshooting FTP login failures by grepping service logs
- Log-audit or compliance scripts that scan logs for leaked secrets
level: medium
id: a3bde688-6d6e-5f00-bdf1-acabc035ec6a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-03
Windows Search of Log Files for FTP Credentials
Detects findstr or PowerShell Select-String searching log files for FTP and password strings, consistent with harvesting plaintext credentials from logs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Windows Search of Log Files for FTP Credentials
description: Detects findstr.exe or PowerShell Select-String used against .log files
with both FTP and password/credential keywords. This matches harvesting of plaintext
FTP credentials that a device or application wrote to logs, after the logs have
been retrieved to a Windows host.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: process_creation
product: windows
detection:
selection_findstr:
Image|endswith: \findstr.exe
selection_ps:
CommandLine|contains: Select-String
selection_log:
CommandLine|contains: .log
selection_ftp:
CommandLine|contains: ftp
selection_cred:
CommandLine|contains:
- passw
- pwd
- credential
condition: (selection_findstr or selection_ps) and selection_log and selection_ftp
and selection_cred
falsepositives:
- Administrators troubleshooting FTP authentication problems in application logs
- Security scanning scripts that look for secrets in logs
level: medium
id: e44a3920-ad58-5094-b4a7-a1dc28a6bae8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-03
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-03
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs