CVE-2025-5748: WOLFBOX Level 2 EV Charger RCE Vulnerability

CVE-2025-5748 Overview

CVE-2025-5748 is a remote code execution vulnerability in the WOLFBOX Level 2 EV Charger. The flaw resides in the Tuya communications module software, which exposes a method allowing the upload of crafted software images over the local area network (LAN) using the over-the-air (OTA) update mechanism. Network-adjacent attackers can leverage this exposed dangerous method [CWE-749] to execute arbitrary code in the context of the device. Authentication is required, but the existing authentication mechanism can be bypassed. The issue was reported through the Zero Day Initiative as ZDI-CAN-26349.

Critical Impact
An attacker on the adjacent network can bypass authentication and push malicious firmware images to the charger, achieving arbitrary code execution with full compromise of the device.

Affected Products

WOLFBOX Level 2 EV Charger (hardware)
WOLFBOX Level 2 EV Charger Firmware version 3.1.17
Tuya communications module embedded in the charger

Discovery Timeline

2025-06-06 - CVE-2025-5748 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5748

Vulnerability Analysis

The vulnerability exists in the LAN-facing OTA update handler of the Tuya communications module inside the WOLFBOX Level 2 EV Charger. The module exposes a method that accepts firmware images from adjacent-network clients without adequately restricting who can invoke it. An attacker who reaches the charger over Wi-Fi or the local network can push a crafted image to the device.

Code executes in the context of the embedded module, giving the attacker control over charging logic, network traffic, and telemetry. Because the device controls high-power electrical hardware, compromise carries operational safety implications beyond typical IoT scenarios. The weakness maps to [CWE-749] Exposed Dangerous Method or Function.

Root Cause

The root cause is an exposed OTA update method in the Tuya module that lacks proper access control. The authentication gate protecting the method can be bypassed, so cryptographic signing or origin validation of firmware images is either missing or insufficient. Any adjacent attacker who reaches the LAN service can invoke it.

Attack Vector

The attack requires adjacent network access, meaning the attacker must sit on the same Wi-Fi network or logical LAN segment as the charger. After bypassing authentication, the attacker calls the OTA method and uploads a malicious firmware image. The device processes the image and executes attacker-controlled code. No user interaction is required.

No verified public proof-of-concept code has been released. See the Zero Day Initiative Advisory ZDI-25-327 for the technical write-up.

Detection Methods for CVE-2025-5748

Indicators of Compromise

Unexpected firmware version strings or build identifiers reported by the charger after a period of normal operation.
OTA update events initiated from local IP addresses rather than the vendor cloud endpoints.
Outbound connections from the charger to non-Tuya or non-WOLFBOX infrastructure.
Unexplained reboots or service restarts of the Tuya communications module.

Detection Strategies

Monitor LAN traffic to and from the charger for OTA-related payloads and large binary uploads originating from local hosts.
Baseline the charger's normal network behavior and alert on deviations in destination IPs, ports, or protocols.
Correlate device firmware version telemetry with authorized update windows.

Monitoring Recommendations

Place the charger on a dedicated VLAN and monitor inter-VLAN attempts targeting it.
Log wireless association events on the network hosting the charger to identify unauthorized adjacent devices.
Track authentication failures and repeated connection attempts against the Tuya module's LAN services.

How to Mitigate CVE-2025-5748

Immediate Actions Required

Isolate the WOLFBOX Level 2 EV Charger on a segmented network with no access from untrusted user devices or guest Wi-Fi.
Restrict inbound access to the charger's LAN services using firewall rules on the network gateway.
Inventory all deployed chargers running firmware 3.1.17 and confirm their network exposure.

Patch Information

At the time of publication, no vendor advisory or patched firmware version is listed in the referenced sources. Consult the Zero Day Initiative Advisory ZDI-25-327 and the WOLFBOX vendor support channels for updated firmware availability.

Workarounds

Disable or block LAN-based OTA update functionality where the device configuration permits.
Enforce WPA2/WPA3 with strong pre-shared keys on the Wi-Fi network hosting the charger and rotate credentials.
Use a firewall to permit only vendor cloud destinations required for legitimate operation.
Physically or logically separate charger management interfaces from general-purpose networks.

bash

# Example network segmentation using iptables on the LAN gateway
# Replace 192.0.2.10 with the charger's IP and 10.0.0.0/24 with your trusted management subnet
iptables -A FORWARD -s 10.0.0.0/24 -d 192.0.2.10 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10 -j DROP
iptables -A FORWARD -s 192.0.2.10 -d 10.0.0.0/24 -j DROP