CVE-2025-5751
📋 TL;DR
This vulnerability allows physically present attackers to bypass authentication on WOLFBOX Level 2 EV Charger Management Cards using hard-coded credentials. Attackers can gain unauthorized access to charger management functions without authentication. Only installations using the affected WOLFBOX Level 2 EV Charger Management Cards are vulnerable.
💻 Affected Systems
- WOLFBOX Level 2 EV Charger Management Card
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could manipulate charging parameters, disable chargers, access user data, or potentially cause electrical safety hazards by overriding safety controls.
Likely Case
Unauthorized access to charger management functions allowing manipulation of charging schedules, pricing, or disabling of charging stations.
If Mitigated
Limited to physical access attempts only, with proper monitoring detecting unauthorized access attempts.
🎯 Exploit Status
Exploitation requires physical access to the management card interface but no authentication or technical expertise beyond using default credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched version
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-330/
Restart Required: Yes
Instructions:
1. Contact WOLFBOX for firmware update
2. Apply firmware patch to management cards
3. Restart charging station
4. Verify new credentials are required for access
🔧 Temporary Workarounds
Physical Access Control
allRestrict physical access to EV charger management card interfaces
Network Segmentation
allIsolate charger management network from other systems
🧯 If You Can't Patch
- Implement strict physical security controls around charging stations
- Monitor for unauthorized access attempts and implement alerting
🔍 How to Verify
Check if Vulnerable:
Attempt to access management interface using default/hard-coded credentials if knownCheck Version:
Check firmware version through management interfaceVerify Fix Applied:
Verify authentication is required and default credentials no longer work📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts
- Successful authentication with default credentials
- Unauthorized configuration changes
Network Indicators:
- Unexpected management interface access patterns
SIEM Query:
Authentication events from EV charger management interfaces