Man-in-the-Middle Vulnerability in Electric Vehicle Charging Protocols by IEC
CVE-2025-12357

7.2HIGH

Key Information:

Vendor

Iso 15118-2 Network And Application Protocol Requirements

Status
Ev Car Chargers
Vendor
CVE Published:
31 October 2025

What is CVE-2025-12357?

This vulnerability allows attackers to exploit the Signal Level Attenuation Characterization (SLAC) protocol by sending spoofed measurements. By doing so, they can execute a man-in-the-middle attack between electric vehicles and ISO 15118-2 compliant chargers. The threat primarily arises from the possibility of wireless exploitation within close proximity, utilizing electromagnetic induction techniques. This could jeopardize the integrity of the data exchanged during charging sessions and potentially compromise the charging process.

Affected Version(s)

EV Car Chargers Part 15118-2 Network and Application Protocol Requirements

References

https://www.iec.ch/contact?id=40499
https://www.cisa.gov/news-events/ics-advisories/icsa-25-3...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mark I. Johnson of Southwest Research Institute reported this vulnerability to CISA.
JSON
.
CVE-2025-12357 : Man-in-the-Middle Vulnerability in Electric Vehicle Charging Protocols by IEC