ZDI-25-327: (0Day) (Pwn2Own) WOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WOLFBOX Level 2 EV Charger. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Tuya communications module software. The issue results from the exposure of a method allowing the upload of crafted software images to the module. An attacker can leverage this vulnerability to execute code in the context of the device.
Other sources
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WOLFBOX Level 2 EV Charger. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2025-5748.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-25-327?
The severity of ZDI-25-327 is high due to its potential for arbitrary code execution by network-adjacent attackers.
How do I fix ZDI-25-327?
To fix ZDI-25-327, update your WOLFBOX Level 2 EV Charger to the latest firmware provided by the vendor.
Who is affected by ZDI-25-327?
ZDI-25-327 affects installations of WOLFBOX Level 2 EV Charger that have not addressed the vulnerability.
What type of attack does ZDI-25-327 enable?
ZDI-25-327 enables network-adjacent attackers to execute arbitrary code on affected devices after bypassing the authentication mechanism.
Is authentication required to exploit ZDI-25-327?
Yes, authentication is required to exploit ZDI-25-327, but it can be bypassed, making it a critical risk.