CVE-2025-5747: WOLFBOX Level 2 EV Charger RCE Vulnerability

CVE-2025-5747 Overview

CVE-2025-5747 is a remote code execution vulnerability in the WOLFBOX Level 2 EV Charger. The flaw resides in the microcontroller unit (MCU) command frame parser, which fails to reliably detect the start of a frame. A network-adjacent, authenticated attacker can misalign frame boundaries and cause the MCU to misinterpret attacker-controlled bytes as command data. When chained with other weaknesses, this allows arbitrary code execution in the context of the device. The issue was reported through the Zero Day Initiative as ZDI-CAN-26501 and published as advisory ZDI-25-326.

Critical Impact
Successful exploitation grants attackers arbitrary code execution on the EV charger MCU, compromising confidentiality, integrity, and availability of the charging device.

Affected Products

WOLFBOX Level 2 EV Charger (hardware)
WOLFBOX Level 2 EV Charger Firmware version 3.1.17
Deployments exposing the charger to adjacent network attackers with valid credentials

Discovery Timeline

2025-06-06 - CVE-2025-5747 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5747

Vulnerability Analysis

The vulnerability is classified under CWE-115: Misinterpretation of Input. The WOLFBOX Level 2 EV Charger MCU receives structured command frames over its communication interface. The parsing routine does not correctly identify the start-of-frame delimiter. As a result, attacker-supplied bytes can be interpreted as the beginning of a new frame at an unintended offset.

This parser desynchronization allows an attacker to inject synthetic command frames that the MCU treats as legitimate control input. The Zero Day Initiative advisory ZDI-25-326 notes that this primitive alone does not yield code execution. It must be chained with additional flaws in the device to reach arbitrary code execution.

Exploitation requires adjacent network access and valid authentication to the charger. Once achieved, the attacker gains control over MCU logic that governs charging behavior, safety interlocks, and firmware-level operations.

Root Cause

The root cause is improper frame delimiter validation inside the MCU command parser. The parser accepts input without confirming the canonical start-of-frame marker, permitting attacker-controlled data to shift the parsing state machine into an invalid configuration.

Attack Vector

An authenticated attacker on an adjacent network sends crafted command frames to the charger. The malformed framing causes the MCU to misparse subsequent bytes and treat them as valid commands. This primitive is combined with a secondary vulnerability to pivot into arbitrary code execution on the device.

No verified public exploit code is available. The vulnerability mechanism is documented in the Zero Day Initiative Advisory ZDI-25-326.

Detection Methods for CVE-2025-5747

Indicators of Compromise

Unexpected MCU command frames originating from local network segments where the charger is deployed
Repeated malformed or truncated frames preceding valid command sequences on the charger management interface
Anomalous firmware behavior such as unauthorized charging state transitions or configuration changes

Detection Strategies

Inspect traffic on the charger management network for command frames lacking correct start-of-frame delimiters
Correlate authenticated sessions with unusual command volume or sequences that deviate from operator baselines
Alert on repeated authentication events from adjacent hosts targeting the charger control plane

Monitoring Recommendations

Enable logging on network segments carrying EV charger management traffic and forward logs to a centralized analytics platform
Baseline normal command patterns for each charger and flag deviations in frame structure or timing
Monitor firmware integrity indicators and configuration state on WOLFBOX chargers for unexpected modification

How to Mitigate CVE-2025-5747

Immediate Actions Required

Isolate WOLFBOX Level 2 EV Chargers on a dedicated, segmented network with no direct exposure to user or guest networks
Restrict management access to a small set of authenticated administrative hosts using firewall rules
Rotate credentials used to authenticate to the charger and enforce strong, unique passwords
Contact WOLFBOX for firmware update guidance for devices running version 3.1.17

Patch Information

No vendor advisory or patched firmware release has been published in the referenced sources at the time of NVD publication. Consult the Zero Day Initiative Advisory ZDI-25-326 and WOLFBOX support channels for updated firmware availability.

Workarounds

Place chargers behind a network firewall that permits only trusted management sources to reach the device
Disable remote management interfaces where operationally feasible until firmware updates are available
Deploy network monitoring on the adjacent network segment to detect malformed frame patterns targeting the MCU

bash

# Configuration example: restrict adjacent-network access to the charger
# Replace variables with values that match your environment
CHARGER_IP="10.20.30.40"
MGMT_HOST="10.20.30.10"

iptables -A FORWARD -s $MGMT_HOST -d $CHARGER_IP -j ACCEPT
iptables -A FORWARD -d $CHARGER_IP -j DROP
iptables -A FORWARD -s $CHARGER_IP -m state --state ESTABLISHED,RELATED -j ACCEPT