CVE-2025-31930 Overview
CVE-2025-31930 affects Siemens VersiCharge electric vehicle (EV) chargers, including IEC 1Ph 7.4kW, IEC 3Ph 22kW, IEC ERK 3Ph 22kW, UL Commercial, and VersiCharge Blue™ product families running firmware versions earlier than V2.135. The affected devices ship with the Modbus service enabled by default and without authentication. An attacker on the same network can issue Modbus commands to remotely control the EV charger, modifying charging behavior and device state. The weakness is tracked under CWE-1188 (insecure default initialization of resource).
Critical Impact
Adjacent-network attackers can remotely control Siemens VersiCharge EV chargers via the default-enabled Modbus service, impacting charger confidentiality, integrity, and availability.
Affected Products
- Siemens IEC 1Ph 7.4kW VersiCharge units (8EM1310-2Exxx-xGxx) running firmware versions earlier than V2.135
- Siemens IEC 3Ph 22kW and ERK 3Ph 22kW VersiCharge units (8EM1310-3Exxx-xGxx, 8EM1310-3Fxxx-xGxx) running firmware versions earlier than V2.135
- Siemens UL Commercial VersiCharge units and VersiCharge Blue™ 80A AC Cellular (8EM131x-xxxxx-xxxx) running firmware versions earlier than V2.135
Discovery Timeline
- 2025-05-13 - CVE-2025-31930 published to the National Vulnerability Database (NVD)
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-31930
Vulnerability Analysis
The affected VersiCharge EV chargers expose a Modbus service that is enabled by default. Modbus is an industrial control protocol that, in its standard TCP form, includes no authentication or transport encryption. Because the service is reachable on the device's local network interface without any access control, any host on the same network segment can issue function code requests to the charger.
An attacker can read internal registers and write to coils or holding registers used by the charger's control logic. This enables remote manipulation of charging sessions, output state, and configuration parameters. The vulnerability impacts confidentiality, integrity, and availability of the charger, and the attack vector is adjacent-network rather than internet-wide.
Root Cause
The root cause is an insecure default configuration (CWE-1188). The Modbus interface is activated out of the box and lacks an authentication layer, so deployment in a flat or insufficiently segmented network exposes control functions to any local peer.
Attack Vector
Exploitation requires network adjacency to the charger, typically via the same LAN, Wi-Fi, or routed segment that the device joins after installation. The attacker connects to the Modbus TCP port and issues function codes such as 0x03 (read holding registers), 0x06 (write single register), or 0x10 (write multiple registers) to read or alter charger state. No credentials, user interaction, or prior compromise of the device is required.
Verified exploit code is not publicly available for CVE-2025-31930. See the Siemens Security Advisory SSA-556937 for vendor technical details.
Detection Methods for CVE-2025-31930
Indicators of Compromise
- Unexpected Modbus TCP sessions to VersiCharge chargers from hosts that are not part of the documented charge management system
- Unscheduled changes to charger state, output current, or session status that do not correlate with backend commands or local user actions
- Charger firmware version reporting a value below V2.135 in asset inventory or vendor management portals
Detection Strategies
- Inspect network traffic on operational technology (OT) and building-management segments for Modbus TCP function codes targeting charger IP addresses
- Compare charger control events recorded in backend logs with Modbus write operations observed on the network to identify out-of-band commands
- Run authenticated scans or passive asset discovery to enumerate VersiCharge units exposing Modbus on their local interfaces
Monitoring Recommendations
- Forward network metadata and OT protocol logs into a centralized analytics platform and alert on Modbus traffic outside an allow-listed set of management hosts
- Baseline normal charger telemetry, then alert on anomalies in session start or stop events, current draw, and configuration register writes
- Track firmware versions of all deployed VersiCharge units and alert when any device reports a version earlier than V2.135
How to Mitigate CVE-2025-31930
Immediate Actions Required
- Upgrade affected VersiCharge units to firmware V2.135 or later as directed by Siemens Security Advisory SSA-556937
- Disable the Modbus service on chargers that do not require it for integration with an energy management or building automation system
- Place chargers on a dedicated, segmented VLAN with access control lists that restrict Modbus traffic to authorized management hosts only
Patch Information
Siemens has published fixed firmware in version V2.135 and later for all affected VersiCharge product variants. Apply the update through the standard VersiCharge management workflow as described in Siemens Security Advisory SSA-556937.
Workarounds
- Restrict access to the Modbus TCP port using upstream firewall or switch ACLs so only the charge management system can reach the charger
- Deploy chargers behind a network gateway that performs Modbus protocol filtering and rejects unauthorized function codes
- Monitor the charger network segment continuously and investigate any new host that initiates Modbus connections to a charger
# Example: restrict Modbus TCP (port 502) to a single management host on a Linux gateway
iptables -A FORWARD -p tcp --dport 502 -s 10.10.20.5 -d 10.10.30.0/24 -j ACCEPT
iptables -A FORWARD -p tcp --dport 502 -d 10.10.30.0/24 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
