What is the CVSS score of EUVD-2025-17313?

EUVD-2025-17313 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Level 2 Ev Charger Firmware are affected by EUVD-2025-17313?

WOLFBOX Level 2 EV Charger devices are vulnerable to authentication bypass attacks without requiring valid credentials, potentially allowing unauthorized control of charging infrastructure.

How to fix or mitigate EUVD-2025-17313?

Within 24 hours: Inventory all WOLFBOX Level 2 EV Charger installations and isolate affected devices to trusted networks only; disable remote management features if available. Within 7 days: Implement network segmentation to restrict charger access to authorized management systems only; document all current charger configurations and access logs for forensic review. Within 30 days: Contact WOLFBOX for patch availability and timeline; evaluate alternative charger solutions with robust authentication; implement continuous network monitoring for unauthorized charger communications.

Level 2 Ev Charger Firmware EUVD-2025-17313

| CVE-2025-5749 HIGH

Use of Uninitialized Variable (CWE-457)

2025-06-06 zdi-disclosures@trendmicro.com

Authentication Bypass Level 2 Ev Charger Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17313

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 16:15 nvd

HIGH 8.8

DescriptionCVE.org

WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of cryptographic keys used in vendor-specific encrypted communications. The issue results from the lack of proper initialization of a variable prior to accessing it. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26295.

AnalysisAI

Critical authentication bypass vulnerability in WOLFBOX Level 2 EV Charger devices caused by uninitialized cryptographic key variables in BLE vendor-specific encrypted communications. Network-adjacent attackers can completely bypass authentication without credentials, gaining full system access (confidentiality, integrity, and availability compromise). The vulnerability (CVSS 8.8) affects encrypted BLE communications and represents a significant risk to EV charging infrastructure security, though real-world exploitation likelihood depends on proximity requirements and patch availability from WOLFBOX.

Technical ContextAI

The vulnerability exists in the Bluetooth Low Energy (BLE) implementation of WOLFBOX Level 2 EV Charger devices, specifically in vendor-specific encrypted communication protocols. The root cause is CWE-457 (Use of Uninitialized Variable), where cryptographic key variables used for BLE encryption are not properly initialized before use. This allows attackers to interact with the authentication mechanism using uninitialized (predictable or null) key values, effectively bypassing the intended encryption-based access control. The issue affects the vendor's proprietary BLE security implementation rather than standard BLE security protocols. The uninitialized variable likely contains a default or predictable state that can be exploited during the key exchange or authentication handshake phases of BLE communication.

RemediationAI

Specific remediation steps: (1) Contact WOLFBOX support for a firmware patch addressing the uninitialized variable in BLE cryptographic key handling; (2) Apply the latest firmware update to all affected WOLFBOX Level 2 charger units when available; (3) Temporary mitigations pending patch: disable BLE functionality if not required for operation, or restrict physical proximity to chargers (secure outdoor installation, barrier placement); (4) Monitor for unexpected BLE connections to chargers and implement network segmentation; (5) Review charger logs for unauthorized authentication attempts. Patch availability and specific firmware versions should be obtained from WOLFBOX's official security advisory (referenced as ZDI-CAN-26295 disclosure). Users should subscribe to WOLFBOX security updates and monitor advisories from the Zero Day Initiative for coordinated disclosure timelines.