CVE-2025-12357CWE-923

CVE-2025-12357

Medium · published October 31, 2025

CVSS v3.1
6.3
EPSS
1%
Percentile
55.8
In the wild
Unconfirmed
What it is

⚠️ A crafty attacker could easily manipulate the SLAC protocol, intercepting communications between electric vehicles and chargers like a sneaky middleman at a coffee shop! ☕️ Think of it as someone eavesdropping on conversations at a cafe, but instead of gossip, they’re swapping out your coffee order for decaf without you noticing! In this case, the SLAC protocol is the conversation and the charger is the barista. If exploited, an attacker could disrupt the charging process of electric vehicles, leading to failures in charging and potential safety hazards. With the rise of electric vehicles, this could cause considerable inconvenience and create trust issues in EV infrastructure.

Put simply

Think of it as someone eavesdropping on conversations at a cafe, but instead of gossip, they’re swapping out your coffee order for decaf without you noticing! In this case, the SLAC protocol is the conversation and the charger is the barista. This vulnerability arises from the ability to spoof measurements in the Signal Level Attenuation Characterization (SLAC) protocol, allowing an attacker to stage a man-in-the-middle attack between EVs and compliant chargers, potentially affecting their functionality.

What to do

If exploited, an attacker could disrupt the charging process of electric vehicles, leading to failures in charging and potential safety hazards. With the rise of electric vehicles, this could cause considerable inconvenience and create trust issues in EV infrastructure. To mitigate this vulnerability, ensure that all devices comply with the latest security standards for SLAC protocol. Regularly update firmware and consider implementing additional authentication measures when establishing connections between vehicles and charging stations. You've got this! Stay proactive, and you'll ensure a smooth ride for electric vehicles! 🛡️

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00789 · 55.8th percentile
Weakness
CWE-923 · Improper Restriction of Communication Channel to Intended Endpoints
Published
2025-10-31T20:15Z
References (3)
EPSS history
Timeline
  • 31 OCT 15:33Z
    International Standards Organization ISO 15118-2 Improper Restriction of Communication Channel to Intended Endpoints
    cvelistv5