CVE-2025-5749: Wolfbox EV Charger Auth Bypass Flaw

CVE-2025-5749 Overview

CVE-2025-5749 is an authentication bypass vulnerability affecting the WOLFBOX Level 2 EV Charger. The flaw resides in the handling of cryptographic keys used for vendor-specific encrypted Bluetooth Low Energy (BLE) communications. The device fails to properly initialize a variable before accessing it, which corresponds to [CWE-457] Use of Uninitialized Variable. A network-adjacent attacker within BLE range can leverage this flaw to bypass authentication without any user interaction or credentials. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-26295 and tracks against firmware version 3.1.17.

Critical Impact
An unauthenticated attacker within BLE range can bypass authentication and gain control of the charger, impacting confidentiality, integrity, and availability of the device.

Affected Products

WOLFBOX Level 2 EV Charger (hardware)
WOLFBOX Level 2 EV Charger Firmware version 3.1.17
BLE communication interface using vendor-specific encrypted channel

Discovery Timeline

2025-06-06 - CVE-2025-5749 published to the National Vulnerability Database
2025-08-14 - Last updated in the NVD database
Reported through Zero Day Initiative as ZDI-CAN-26295, published as advisory ZDI-25-328

Technical Details for CVE-2025-5749

Vulnerability Analysis

The vulnerability exists in the BLE communication stack of the WOLFBOX Level 2 EV Charger. The charger uses a vendor-specific encrypted protocol over BLE to authenticate mobile applications and remote management clients. During this exchange, the firmware references a cryptographic key variable that has not been properly initialized prior to use. An attacker who can establish a BLE connection to the charger can interact with the authentication routine while it operates on undefined or predictable memory. This allows the attacker to bypass the authentication check entirely and issue privileged commands to the device.

The weakness maps to [CWE-457], Use of Uninitialized Variable. Because the encryption keys are part of the trust boundary between the mobile client and the charger, undermining their initialization collapses the authentication model for the BLE channel.

Root Cause

The firmware allocates storage for cryptographic key material but does not zero or populate that storage before the authentication handler reads from it. When the handler computes or compares encrypted values, it operates against the uninitialized buffer. The result is a deterministic or attacker-influenced state that satisfies the authentication check without legitimate credentials.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be within BLE radio range of the target charger. No authentication, credentials, or user interaction are required. The attacker establishes a BLE session with the charger, triggers the vendor-specific encrypted handshake, and abuses the uninitialized key state to bypass authentication. Once authenticated, the attacker can issue management commands, modify charging behavior, or disrupt service.

No public proof-of-concept code is available for CVE-2025-5749. Refer to the Zero Day Initiative advisory ZDI-25-328 for additional technical context.

Detection Methods for CVE-2025-5749

Indicators of Compromise

Unexpected BLE pairing or connection events to the charger from unknown device addresses
Charger configuration changes (charging schedules, current limits, network settings) that were not initiated by an authorized operator
Unauthorized firmware command sequences observed in device logs or backend telemetry
Charging sessions starting or stopping without a corresponding authenticated user action in the management app

Detection Strategies

Monitor backend cloud telemetry for the charger fleet for command patterns that do not correlate with authenticated mobile-app actions
Capture BLE traffic in environments where chargers are deployed and inspect for repeated handshake attempts from unfamiliar MAC addresses
Alert on firmware versions still reporting 3.1.17 across the fleet via asset inventory

Monitoring Recommendations

Forward charger event logs and cloud management API logs into a centralized SIEM or data lake for correlation
Establish a baseline of normal BLE connection frequency per charger and alert on deviations
Track physical access and proximity events at deployment sites where chargers are publicly accessible

How to Mitigate CVE-2025-5749

Immediate Actions Required

Inventory all WOLFBOX Level 2 EV Chargers and identify any units running firmware 3.1.17 or earlier
Apply the vendor-provided firmware update once available from WOLFBOX through the official update channel
Restrict physical and radio-frequency proximity to deployed chargers where feasible, particularly in publicly accessible locations
Disable or limit BLE management functionality if the vendor provides such a configuration option

Patch Information

At the time of NVD publication, no vendor advisory URL is listed beyond the Zero Day Initiative coordination record. Owners and operators should consult the Zero Day Initiative advisory ZDI-25-328 and contact WOLFBOX directly for an updated firmware release that initializes BLE cryptographic key material before use.

Workarounds

Place chargers in locations that minimize BLE exposure to untrusted individuals, such as gated or monitored facilities
Where supported, configure the charger to require cloud-based management only and disable local BLE provisioning after initial setup
Monitor the charger's cloud management portal for anomalous session activity and revoke unknown paired devices

bash

# Example: track firmware versions across a fleet via the vendor API
# (replace endpoint and auth token with your environment values)
curl -H "Authorization: Bearer $TOKEN" \
     https://api.example-wolfbox-mgmt/v1/devices \
  | jq '.devices[] | select(.firmware=="3.1.17") | {id, site, firmware}'