Black Hat USA 2025 | Peril at the Plug: Investigating EV Charger Security and Safety Failures

Why It Matters

These flaws expose EV chargers to attacks that can cause fires, equipment damage, and large‑scale grid disruptions, demanding immediate industry‑wide security upgrades.

Key Takeaways

• EV chargers expose large attack surface across hardware and software.
• Simple bugs enable remote firmware downgrade and full device compromise.
• Manipulating charge protocol can force dangerous over‑current conditions.
• Lack of memory protection allows single‑step remote code execution.
• Hardware modifications bypass software safeties, risking fire hazards.

Summary

The Black Hat USA 2025 presentation titled “Peril at the Plug” examined the alarming security and safety gaps in electric‑vehicle (EV) chargers, drawing on findings from the PON (Pon Automotive) hacking contest. The speakers outlined the extensive attack surface—multiple CPUs, operating systems, cloud links, Bluetooth‑enabled mobile apps, and a plethora of network protocols—making chargers ripe for exploitation. Key insights included a surge of low‑complexity bugs such as buffer overflows, authentication flaws, and command injection, many of which persisted across 2024‑2025 contests. Notable exploits featured a Raspberry‑Pi‑driven firmware downgrade of a Tesla wall connector exposing debug services, an out‑of‑bounds write in an Autel charger’s USB setup packet, and a cloned RFID reset on Wolf‑Box devices that allowed malicious firmware injection. These vulnerabilities enabled remote code execution without memory protection and even fleet‑wide compromise via cloud bugs. The researchers demonstrated how manipulating the control‑pilot PWM duty cycle can force chargers to deliver up to 80 A, far beyond safe limits, and built a 27 kW load‑bank rig to test over‑current scenarios. By physically rerouting the relay‑control pin, they bypassed software safeguards, showing that hardware‑level safety mechanisms are often absent, raising the specter of fires or infrastructure damage. The findings underscore a pressing need for manufacturers to harden both firmware and hardware, enforce memory protection, and implement robust, tamper‑resistant safety circuits. Regulators and standards bodies may soon require stricter certification to prevent dangerous over‑current attacks and protect consumers and the power grid.

Original Description

The past few years have seen a rapid increase in Level 2 EV charging equipment (EVSE) options for consumers. Along with choosing the right equipment, EV owners face installation decisions, such as hiring specialized installers or doing it themselves. However, many consumers are unaware of the cybersecurity risks inherent in all chargers. Vulnerability bounty programs have shown that even simple remote attacks can take full control of these devices. These challenges create an environment of safety risks that can endanger life and property.

Our research examines the real-world consequences of compromised EVSE through the destructive testing of seven different products. We begin by reviewing common remote attacks found across various EV chargers and disclose several recently identified zero-day vulnerabilities. We then introduce a testing methodology simulating a worst-case scenario where a malicious actor bypasses safety mechanisms to cause maximum damage. The results include video footage of the tests, showcasing any destruction, collateral damage, and latent hazards. Lastly, we offer recommendations for enhancing safety through security best practices, hardware design, and implementation.

Attendees will gain insight into the current state of EVSE security, how to assess EVSE safety mechanisms and the real-world dangers of using EVSE with safety features that can be bypassed via compromise.

By:

Jonathan Andersson | Sr. Manager Security Research, Trend Micro

Thanos Kaliyanakis | Vulnerability Researcher, Trend Micro

Full Session Details Available at:

https://blackhat.com/us-25/briefings/schedule/?#peril-at-the-plug-investigating-ev-charger-security-and-safety-failures-45434