CVE-2025-5517 Overview
CVE-2025-5517 is a heap-based buffer overflow [CWE-122] affecting multiple ABB Terra AC wallbox electric vehicle charger models. The flaw resides in firmware shared across the UL40/80A, UL32A, MID, Juno CE, PTB, and JP variants of the product line. An authenticated attacker on the network can trigger the overflow to compromise the integrity and availability of the charger. The vulnerability requires low privileges and a network attack vector, but exploitation complexity is high because the attack depends on specific runtime conditions.
Critical Impact
Successful exploitation can corrupt heap memory on the Terra AC wallbox, allowing an authenticated attacker to alter charger operation and force a denial of service on connected EV charging infrastructure.
Affected Products
- ABB Terra AC wallbox (UL40/80A) through version 1.8.32
- ABB Terra AC wallbox (UL32A) through version 1.8.2; Terra AC wallbox (JP) through version 1.8.2
- ABB Terra AC wallbox (MID/CE) - Terra AC MID and Terra AC Juno CE through version 1.8.32; Terra AC PTB through version 1.8.21
Discovery Timeline
- 2025-10-20 - CVE-2025-5517 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5517
Vulnerability Analysis
The Terra AC wallbox firmware contains a heap-based buffer overflow reachable over the network by an authenticated user. The condition falls under [CWE-122], where a program writes past the bounds of a heap-allocated buffer. On an embedded charger controller, this class of memory corruption can overwrite adjacent heap metadata or in-use objects that govern charging state machines and communication handlers.
ABB's advisory describes impact on integrity and availability but not confidentiality. This aligns with a corruption primitive that can alter runtime state or crash the device rather than exfiltrate data. Because the wallbox coordinates high-power AC charging, memory corruption in the control logic carries operational safety implications for connected vehicles and premises wiring.
Root Cause
The root cause is insufficient bounds checking on input handled by the firmware's network-facing service. When attacker-supplied data exceeds the size of the destination heap buffer, the overflow overwrites adjacent heap regions. The high attack complexity indicated by the CVSS vector suggests the attacker must satisfy specific preconditions, such as a particular device state or message sequence, to reliably reach the vulnerable code path.
Attack Vector
Exploitation requires network access to the wallbox and valid low-privilege credentials. An attacker with a foothold on the same network segment as the charger, or with harvested user credentials, can send crafted messages to the vulnerable service and trigger the overflow. See the ABB security advisory for protocol-specific technical detail.
No verified proof-of-concept code is publicly available for CVE-2025-5517.
Refer to the ABB advisory for firmware-level technical details.
Detection Methods for CVE-2025-5517
Indicators of Compromise
- Unexpected reboots, watchdog resets, or crash loops on Terra AC wallbox units running the affected firmware versions.
- Charger sessions terminating abnormally or the device dropping off the management platform after receiving network traffic from an internal host.
- Authenticated management sessions originating from unusual IP addresses or at unusual times.
Detection Strategies
- Inventory all Terra AC wallbox units and compare running firmware against the vulnerable ranges listed by ABB.
- Inspect network flows to and from wallbox management ports for oversized or malformed payloads originating inside the operational technology network.
- Correlate authentication events on chargers with subsequent device instability to identify potential exploitation attempts.
Monitoring Recommendations
- Forward wallbox event logs and management platform telemetry to a central SIEM for retention and correlation.
- Alert on repeated failed authentications against charger management interfaces followed by successful logins.
- Monitor for firmware version drift and unauthorized configuration changes across the wallbox fleet.
How to Mitigate CVE-2025-5517
Immediate Actions Required
- Identify all Terra AC wallbox units and confirm firmware versions against ABB's fixed release list.
- Apply the firmware update published by ABB for each affected model as soon as maintenance windows allow.
- Rotate credentials used for wallbox authentication and remove any unused local accounts.
Patch Information
ABB has published a security advisory and remediated firmware for the affected Terra AC wallbox variants. Consult the ABB Terra AC wallbox security advisory for the fixed version numbers corresponding to each hardware variant and for installation guidance.
Workarounds
- Segment wallbox devices onto a dedicated VLAN and restrict management access to a small set of trusted administrative hosts.
- Block inbound access to the charger management interfaces from user, guest, and internet-facing networks.
- Enforce strong, unique credentials for every wallbox account and disable any default or shared accounts.
# Example: restrict wallbox management access at the firewall
# Replace 10.10.20.0/24 with the wallbox subnet and 10.10.99.10 with the admin host
iptables -A FORWARD -s 10.10.99.10 -d 10.10.20.0/24 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.10.20.0/24 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
