PT-2025-44639 · Unknown · Iso 15118-2

Sébastien Dudek · Published 2025-10-31 · Updated 2026-03-31 · CVE-2025-12357

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ISO 15118-2 compliant EV charging systems (affected versions not specified)

Description A flaw exists in the Signal Level Attenuation Characterization (SLAC) protocol used in electric vehicle (EV) charging systems that adhere to the ISO 15118-2 standard. This allows an attacker to manipulate measurements within the SLAC protocol to conduct a man-in-the-middle (MITM) attack. The attack can be performed wirelessly within a limited range using electromagnetic induction, enabling the attacker to intercept, modify, or forge communication between an electric vehicle and the charging station. This could lead to session hijacking and data exposure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-923

Related Identifiers

CVE-2025-12357

Affected Products

Iso 15118-2

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-12357 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-303-01.json · Note
• https://twitter.com/CveTodo/status/1984296389967265991 · Twitter Post
• https://iec.ch/contact?id=40499 · Note
• https://twitter.com/ZeroPathLabs/status/1984298233510650073 · Twitter Post
• https://twitter.com/threatcluster/status/2039017472402084127 · Twitter Post
• https://t.me/CVEtracker/36314 · Telegram Post
• https://twitter.com/CVEnew/status/1984312786110070855 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-303-01 · Note