CVE-2025-5749: fallo de gravedad media en WOLFBOX Level 2 EV Charger
WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.3epss 0.2%
WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of cryptographic keys used in vendor-specific encrypted communications. The issue results from the lack of proper initialization of a variable prior to accessing it. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26295.
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Productos afectados
WOLFBOX · Level 2 EV ChargerCVEs relacionadas — WOLFBOX Level 2 EV Charger
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-5748HIGHWOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-5750HIGHWOLFBOX Level 2 EV Charger tuya_svc_devos_activate_result_parse Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-5747HIGHWOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-5751MEDIUMWOLFBOX Level 2 EV Charger Management Card Hard-coded Credentials Authentication Bypass VulnerabilityEPSS 0.3%