CVE-2025-5749

Status: AnalyzedHigh (8.8)—

WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of cryptographic keys used in vendor-specific encrypted communications. The issue results from the lack of proper initialization of a variable prior to accessing it. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26295.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base score: 8.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.21%
Percentile among all scored CVEs: 10
Score date: 10/5/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement95 %
Primary impactT1078 Valid Accountsstealth · persistence · privilege escalation · initial access85 %
Secondary impactT1098 Account Manipulationpersistence · privilege escalation75 %

AV:A + acceso remoto a dispositivo sin autenticación vía BLE. Bypass de autenticación permite obtener acceso de cuenta/sesión al cargador. CWE-457 confirma variable no inicializada en criptografía.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account Management User Account Management Network Segmentation Multi-factor Authentication Disable or Remove Feature or Program Application Developer Guidance

Affected technologies (1)

Wolfbox — Level 2 EV Charger Firmware

CWEs

CWE-457

References

https://www.zerodayinitiative.com/advisories/ZDI-25-328/

Raw JSON (NVD)

Show

{
  "id": "CVE-2025-5749",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-5749",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-06T15:53:52.428787Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "zdi-disclosures@trendmicro.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.3,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "zdi-disclosures@trendmicro.com",
      "affectedData": [
        {
          "vendor": "WOLFBOX",
          "product": "Level 2 EV Charger",
          "versions": [
            {
              "status": "affected",
              "version": "3.1.17 (main), 1.2.6 (MCU)"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-06-06T16:15:30.120",
  "references": [
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-328/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "zdi-disclosures@trendmicro.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-457"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of cryptographic keys used in vendor-specific encrypted communications. The issue results from the lack of proper initialization of a variable prior to accessing it. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26295."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de omisión de autenticación de variables no inicializadas en las claves de cifrado del cargador de vehículos eléctricos WOLFBOX Nivel 2 BLE. Esta vulnerabilidad permite a atacantes adyacentes a la red omitir la autenticación en las instalaciones afectadas de cargadores de vehículos eléctricos WOLFBOX Nivel 2. No se requiere autenticación para explotar esta vulnerabilidad. La falla específica se encuentra en el manejo de las claves criptográficas utilizadas en las comunicaciones cifradas específicas del proveedor. El problema se debe a la falta de inicialización correcta de una variable antes de acceder a ella. Un atacante puede aprovechar esta vulnerabilidad para omitir la autenticación en el sistema. Anteriormente, se denominó ZDI-CAN-26295."
    }
  ],
  "lastModified": "2026-06-17T09:48:41.177",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wolfbox:level_2_ev_charger_firmware:3.1.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7DA2D942-F877-4620-A470-63275137F55F"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wolfbox:level_2_ev_charger:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "27090DB5-F57A-486A-94FF-3B38C1A35613"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "zdi-disclosures@trendmicro.com"
}