# LITEON EV chargers leak FTP credentials in plaintext logs

Published: 2025-07-15 · Severity: routine · Sectors: energy, transportation, infrastructure
Canonical: https://vorant.io/reports/6ede22b3-d018-53d3-99a7-9b039f9afe8c/liteon-ev-chargers-leak-ftp-credentials-in-plaintext-logs

> LITEON IC48A and IC80A EV chargers store FTP credentials in cleartext; remotely exploitable for credential disclosure.

LITEON IC48A firmware versions prior to 01.00.19r and IC80A firmware versions prior to 01.01.12e contain a plaintext storage vulnerability (CVE-2025-7357, CWE-256) where FTP-server-access-credentials are exposed in system logs. The vulnerability is remotely exploitable with low attack complexity and no authentication required, earning a CVSS v4 score of 8.7. Successful exploitation allows attackers to extract sensitive credentials for accessing the chargers' FTP interfaces.

LITEON has released patched firmware: IC48A version 01.00.20h and IC80A version 01.01.13m. The chargers are deployed worldwide across commercial facilities, energy, and transportation sectors. CISA reports no known public exploitation to date. Defenders should prioritize network segmentation—isolating charger infrastructure from direct internet access, deploying behind firewalls, and requiring VPN for remote access—while applying available firmware updates.

## Mentioned in this report

- Vulnerabilities: CVE-2025-7357

## Detection guidance (public sample)

### Linux Grep of System Logs for FTP Credentials

ATT&CK: T1552.001

Detects grep-style tools searching /var/log for FTP and password/credential strings, which matches hunting for plaintext FTP credentials leaked into logs (CVE-2025-7357 pattern). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Linux Grep of System Logs for FTP Credentials
description: Detects grep/zgrep/egrep/awk/sed run against /var/log content with both
  an FTP keyword and a password/credential keyword. This matches harvesting of plaintext
  FTP credentials leaked into system logs, as in the LITEON charger CVE-2025-7357
  pattern. Generalises on the tool plus log path plus credential keywords, not on
  any specific log file name.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
    - /grep
    - /egrep
    - /fgrep
    - /zgrep
    - /awk
    - /sed
  selection_path:
    CommandLine|contains: /var/log
  selection_ftp:
    CommandLine|contains: ftp
  selection_cred:
    CommandLine|contains:
    - passw
    - pwd
    - credential
  condition: all of selection_*
falsepositives:
- Administrators troubleshooting FTP login failures by grepping service logs
- Log-audit or compliance scripts that scan logs for leaked secrets
level: medium
id: a3bde688-6d6e-5f00-bdf1-acabc035ec6a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-03
```

### Windows Search of Log Files for FTP Credentials

ATT&CK: T1552.001

Detects findstr or PowerShell Select-String searching log files for FTP and password strings, consistent with harvesting plaintext credentials from logs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Windows Search of Log Files for FTP Credentials
description: Detects findstr.exe or PowerShell Select-String used against .log files
  with both FTP and password/credential keywords. This matches harvesting of plaintext
  FTP credentials that a device or application wrote to logs, after the logs have
  been retrieved to a Windows host.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_findstr:
    Image|endswith: \findstr.exe
  selection_ps:
    CommandLine|contains: Select-String
  selection_log:
    CommandLine|contains: .log
  selection_ftp:
    CommandLine|contains: ftp
  selection_cred:
    CommandLine|contains:
    - passw
    - pwd
    - credential
  condition: (selection_findstr or selection_ps) and selection_log and selection_ftp
    and selection_cred
falsepositives:
- Administrators troubleshooting FTP authentication problems in application logs
- Security scanning scripts that look for secrets in logs
level: medium
id: e44a3920-ad58-5094-b4a7-a1dc28a6bae8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-03
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6ede22b3-d018-53d3-99a7-9b039f9afe8c/liteon-ev-chargers-leak-ftp-credentials-in-plaintext-logs.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup