CVE-2025-27575
📋 TL;DR
An unauthenticated attacker can retrieve EV charger version information and firmware upgrade history by knowing the charger's identifier. This information disclosure vulnerability affects electric vehicle charging systems that expose this data without proper authentication controls.
💻 Affected Systems
- EV charging systems
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map all EV chargers in a network, identify outdated firmware versions, and plan targeted attacks against known vulnerable systems.
Likely Case
Information gathering that enables reconnaissance for future attacks, potentially revealing system architecture and update patterns.
If Mitigated
Limited exposure of non-sensitive metadata with no direct path to compromise.
🎯 Exploit Status
Simple HTTP request with known charger ID required
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific versions
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
Restart Required: Yes
Instructions:
1. Consult vendor advisory for affected products
2. Apply vendor-provided firmware updates
3. Restart charging systems after update
🔧 Temporary Workarounds
Network segmentation
allIsolate EV charging systems from untrusted networks
Access control implementation
allImplement authentication for charger information endpoints
🧯 If You Can't Patch
- Segment EV charging network from internet and untrusted internal networks
- Implement network monitoring for unauthorized access attempts to charger endpoints
🔍 How to Verify
Check if Vulnerable:
Test if unauthenticated requests to charger information endpoints return version/history dataCheck Version:
Vendor-specific command; check device management interfaceVerify Fix Applied:
Verify authentication is required for charger information endpoints after update📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to charger information endpoints
- Multiple failed authentication attempts
Network Indicators:
- Unusual HTTP requests to charger management interfaces
- Reconnaissance patterns targeting charger IDs
SIEM Query:
source="ev_charger_logs" AND (event="unauthorized_access" OR event="information_disclosure")