CVE-2025-5747
📋 TL;DR
This vulnerability allows network-adjacent attackers with authentication to execute arbitrary code on WOLFBOX Level 2 EV Charger devices by exploiting improper command frame parsing in the MCU. The flaw enables remote code execution when combined with other vulnerabilities, potentially compromising charger functionality and security. Only authenticated attackers on the same network can exploit this vulnerability.
💻 Affected Systems
- WOLFBOX Level 2 EV Charger
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to disable charging, manipulate billing data, access connected vehicle networks, or use the charger as an entry point to other network systems.
Likely Case
Disruption of charging services, unauthorized access to charger settings, or data exfiltration from the device.
If Mitigated
Limited impact due to authentication requirements and network segmentation, potentially only affecting charger availability.
🎯 Exploit Status
Requires authentication and network adjacency. The advisory mentions leveraging with other vulnerabilities for RCE.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Monitor vendor website for firmware updates and apply when released.
🔧 Temporary Workarounds
Network Segmentation
allIsolate EV chargers on dedicated network segments with strict access controls
Authentication Hardening
allImplement strong authentication mechanisms and limit administrative access
🧯 If You Can't Patch
- Implement strict network segmentation to isolate chargers from critical systems
- Monitor network traffic to/from chargers for anomalous command patterns
🔍 How to Verify
Check if Vulnerable:
Check device model and firmware version against vendor advisory when availableCheck Version:
Check via charger management interface or vendor documentationVerify Fix Applied:
Verify firmware version matches patched version from vendor when available📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts
- Abnormal command frame patterns
- MCU error messages
Network Indicators:
- Malformed network packets to charger management ports
- Unusual traffic patterns to charger IPs
SIEM Query:
source_ip IN (charger_ips) AND (protocol_anomaly OR auth_failure OR command_parsing_error)