CVE-2025-12357
BaseFortify
Publication date: 2025-10-31
Last updated on: 2026-03-17
Assigner: ICS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-923 | The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves manipulating the Signal Level Attenuation Characterization (SLAC) protocol by using spoofed measurements to stage a man-in-the-middle (MitM) attack between an electric vehicle (EV) and chargers that comply with the ISO 15118-2 standard. The attack can be conducted wirelessly within close proximity via electromagnetic induction, allowing an attacker to intercept or alter communications between the EV and the charger. [2]
How can this vulnerability impact me? :
The vulnerability can allow an attacker to intercept and potentially alter communications between an electric vehicle and its charger, which could lead to unauthorized control or disruption of charging sessions. This could impact the reliability and security of EV charging infrastructure, potentially causing service interruptions or unauthorized access to the charging process. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing Transport Layer Security (TLS) for all communications between electric vehicles and chargers, ensuring proper certificate chaining as recommended in ISO 15118-20 and ISO 15118-2. Additionally, minimize network exposure of control system devices, isolate control system networks behind firewalls, and use secure remote access methods such as updated VPNs. Conduct impact analysis and risk assessments before deploying defenses and follow CISA's recommended cybersecurity best practices for industrial control systems (ICS). [2]