Threats Tagged 'cve-2025-12357'

CVE-2025-12357 is a medium-severity vulnerability in the ISO 15118-2 protocol used by electric vehicle (EV) chargers. It involves manipulation of the Signal Level Attenuation Characterization (SLAC) protocol via spoofed measurements, enabling a man-in-the-middle (MitM) attack between an EV and its charger. The attack can be conducted wirelessly within close proximity through electromagnetic induction, without requiring authentication or user interaction. This vulnerability impacts confidentiality, integrity, and availability of the charging communication, potentially allowing attackers to intercept or alter charging commands and data. No known exploits are currently in the wild, and no patches have been published yet. Organizations deploying ISO 15118-2 compliant EV chargers should prioritize mitigation to prevent unauthorized access and data manipulation. Countries with significant EV adoption and infrastructure, such as the United States, Germany, China, Japan, and others, are at higher risk. The vulnerability’s CVSS score is 6.3, reflecting medium severity due to its remote attack vector but limited scope and impact. Defenders should implement network segmentation, monitor for anomalous SLAC traffic, and apply vendor updates once available.

MediumVulnerabilityUnited StatesGermanyChina+8#cve#cve-2025-12357#cwe-923