Is there a public PoC exploit available for CVE-2025-8348?

Yes, a public proof-of-concept exploit is available for CVE-2025-8348. Prioritise patching immediately. EPSS: 0.2%.

Kehua Charging Platform CVE-2025-8348

Q: What is the CVSS score of CVE-2025-8348?

CVE-2025-8348 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

MEDIUM

Improper Authentication (CWE-287)

2025-07-31 cna@vuldb.com

Authentication Bypass Charging Pile Cloud Platform

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible authentication bypass requires no privileges or interaction; partial C/I/A reflects platform-level access without full system compromise and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:41 vuln.today

CVE Published

Jul 31, 2025 - 04:16 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability has been found in Kehua Charging Pile Cloud Platform 1.0 and classified as critical. This vulnerability affects unknown code of the file /home. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Authentication bypass in Kehua Charging Pile Cloud Platform 1.0 exposes the /home endpoint to unauthenticated remote attackers via manipulation of authentication controls, classified under CWE-287 (Improper Authentication). The CVSS 4.0 vector confirms no privileges or user interaction are required (PR:N/UI:N/AV:N/AC:L), with partial confidentiality, integrity, and availability impact against the vulnerable system. A public proof-of-concept exploit has been disclosed with no vendor response or patch available, elevating practical risk despite a low EPSS score of 0.17% (38th percentile) and absence from the CISA KEV catalog.

Technical ContextAI

The affected product is an internet-facing cloud management platform for EV (Electric Vehicle) charging infrastructure, identified by CPE cpe:2.3:a:kehua:charging_pile_cloud_platform:1.0:*:*:*:*:*:*:*. CWE-287 (Improper Authentication) indicates the application fails to adequately verify user identity before granting access, specifically at the /home route. This class of flaw typically arises from missing authentication middleware on specific endpoints, bypassable session validation, or parameter-based access control that can be manipulated client-side. As a cloud-hosted platform managing physical EV charging infrastructure, successful exploitation of authentication controls could expose operator dashboards, session management data, and potentially the ability to interact with connected charging devices.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, and no official fix version is available. As an immediate compensating control, operators should restrict network access to the /home endpoint using perimeter firewall rules or WAF policies, blocking unauthenticated external requests to this specific path; note this may affect any legitimate unauthenticated flows if present. Placing the platform behind a VPN or requiring network-level authentication (e.g., IP allowlisting to known operator networks) will compensate for the application-layer bypass, though this may impact operational accessibility for remote users. Organizations should actively monitor web server access logs for unexpected or anomalous requests to /home as an indicator of exploitation attempts. Contact Kehua directly for patch status and reference VulDB submission https://vuldb.com/?submit.617568 when engaging the vendor.