IoT CVE-2025-5748

Risk assessment across multiple signal dimensions: CVSS 8.0 (High) with AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-adjacent attack requirement, low attack complexity, requirement for low privileges (but bypassable), no user interaction needed, and high confidentiality, integrity, and availability impact. The CVSS vector reflects a serious vulnerability, though the Adjacent access vector requirement (AV:A) limits exposure compared to network-based attacks. The SSVC framework context: exploitation appears feasible given the exposed method and known ZDI disclosure (ZDI-CAN-26349), automatable attacks are highly probable due to the programmatic nature of OTA uploads, and technical impact is complete system compromise. While specific EPSS scores and KEV inclusion status are not provided in the source data, the combination of ZDI coordination, authentication bypass, and exposed dangerous methods strongly suggests active research and potential POC availability in security communities. Real-world priority is HIGH for any organization operating WOLFBOX EV charger deployments, particularly in fleet/commercial settings where multiple chargers may be affected. The LAN-only requirement reduces exposure in strictly segmented networks but remains critical for most IoT/charger installations with standard network configurations.

Attack scenario: An attacker on the same network segment (or with network access to the charger's LAN interface) identifies a WOLFBOX Level 2 EV Charger connected to the network. The attacker leverages the known authentication bypass vulnerability to bypass Tuya module authentication requirements. Using the exposed OTA upload method, the attacker crafts a malicious firmware image containing arbitrary code (e.g., reverse shell, credential harvester, or device control logic) and uploads it via the unprotected upload endpoint. The Tuya module accepts and executes the uploaded image without validation. The attacker gains code execution in the Tuya communication module context, and from there can pivot to the host EV charger system, potentially: disabling charging functionality, modifying billing data, extracting user/vehicle credentials, or using the compromised charger as a pivot point for further network attacks. Exploitation is automatable and repeatable, requiring minimal tools (HTTP client, crafted firmware). POC existence is likely given ZDI historical practices, though not explicitly confirmed in provided data.