CVE-2025-5748
BaseFortify
Publication date: 2025-06-06
Last updated on: 2025-08-14
Assigner: Zero Day Initiative
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wolfbox | level_2_ev_charger_firmware | 3.1.17 |
| wolfbox | level_2_ev_charger | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-749 | The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the WOLFBOX Level 2 EV Charger and involves a flaw in the Tuya communications module software. It exposes a method that allows an attacker to upload crafted software images to the device. Although authentication is normally required, the authentication mechanism can be bypassed, enabling a network-adjacent attacker to execute arbitrary code on the device remotely. [1]
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can execute arbitrary code on the affected EV charger, potentially gaining control over the device. This can lead to compromise of device confidentiality, integrity, and availability, meaning sensitive data could be exposed or altered, and the device could be disrupted or disabled. [1]
What immediate steps should I take to mitigate this vulnerability?
Since the vulnerability allows remote code execution via an exposed method in the Tuya communications module and authentication can be bypassed, immediate mitigation steps include restricting network access to the WOLFBOX Level 2 EV Charger devices to trusted networks only, disabling or isolating the affected Tuya communications module if possible, and monitoring for any unusual activity. As no official remediation or patch is available due to unsuccessful contact with the vendor, network-level controls and limiting exposure are critical. [1]