« Volver al listado

CVE-2025-5748

Estado: AnalizadaAlta (8)—

WOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WOLFBOX Level 2 EV Charger. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the Tuya communications module software. The issue results from the exposure of a method allowing the upload of crafted software images to the module. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26349.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:A/PR:L sin UI indica acceso red adyacente con privilegios; exposición de método de carga de firmware permite ejecución de código arbitrario. Escalada implícita en dispositivo embebido.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementExecution PreventionDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

Wolfbox — Level 2 EV Charger Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-5748",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-5748",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-06T15:53:29.890180Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "zdi-disclosures@trendmicro.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "zdi-disclosures@trendmicro.com",
      "affectedData": [
        {
          "vendor": "WOLFBOX",
          "product": "Level 2 EV Charger",
          "versions": [
            {
              "status": "affected",
              "version": "3.1.17 (main), 1.2.6 (MCU)"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-06-06T16:15:29.973",
  "references": [
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-327/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "zdi-disclosures@trendmicro.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-749"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "WOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WOLFBOX Level 2 EV Charger. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the Tuya communications module software. The issue results from the exposure of a method allowing the upload of crafted software images to the module. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26349."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecución remota de código por método peligroso expuesta en la LAN del cargador de vehículos eléctricos WOLFBOX Nivel 2. Esta vulnerabilidad permite a atacantes adyacentes a la red ejecutar código arbitrario en las instalaciones afectadas del cargador de vehículos eléctricos WOLFBOX Nivel 2. Si bien se requiere autenticación para explotar esta vulnerabilidad, el mecanismo de autenticación existente puede eludirse. La falla específica se encuentra en el software del módulo de comunicaciones Tuya. El problema se debe a la exposición de un método que permite la carga de imágenes de software manipuladas al módulo. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del dispositivo. La vulnerabilidad era ZDI-CAN-26349."
    }
  ],
  "lastModified": "2026-06-17T09:48:41.007",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wolfbox:level_2_ev_charger_firmware:3.1.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7DA2D942-F877-4620-A470-63275137F55F"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wolfbox:level_2_ev_charger:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "27090DB5-F57A-486A-94FF-3B38C1A35613"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "zdi-disclosures@trendmicro.com"
}