Read the docs
TI-2025-05187 Aliases CVE-2025-5749GHSA-2w7j-pwrp-qpxj

WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication…

Priority LOW 37CWE-457Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of cryptographic keys used in vendor-specific encrypted communications. The issue results from the lack of proper initialization of a variable prior to accessing it. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26295.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00219 12th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WOLFBOXLevel 2 EV Charger3.1.17 (main), 1.2.6 (MCU)—No fix listedCNA
  • Level 2 EV Charger VendorWOLFBOX Affected 3.1.17 (main), 1.2.6 (MCU) Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:wolfbox:level_2_ev_charger_firmware:3.1.17:*:*:*:*:*:*:*3.1.17VulnerableWOLFBOX
cpe:2.3:h:wolfbox:level_2_ev_charger:-:*:*:*:*:*:*:*not specified by NVDRunning onWOLFBOX
  • cpe:2.3:o:wolfbox:level_2_ev_charger_firmware:3.1.17:*:*:*:*:*:*:* Versions 3.1.17 Vulnerable ·WOLFBOX
  • cpe:2.3:h:wolfbox:level_2_ev_charger:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WOLFBOX

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-5749
  2. 2026-10-03 Alias added: GHSA-2w7j-pwrp-qpxj

References

Advisory 1

  • TI-2025-05188 Heap-based buffer overflow in WOLFBOX Level 2 EV Charger CVSS 3.0HIGH 8.8
  • TI-2025-05186 WOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution… CVSS 3.0HIGH 8.0
  • TI-2025-05185 WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code… CVSS 3.0HIGH 8.0
  • TI-2025-05189 Hard-coded credentials in WOLFBOX Level 2 EV Charger CVSS 3.1MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences