The specific flaw exists within the handling of cryptographic keys used in vendor-specific encrypted communications. The issue results from the lack of proper initialization of a variable prior to accessing it. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26295.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| WOLFBOX | Level 2 EV Charger | unknown |
|
Configuration 1 [-]
| AND |
|
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-17313 | WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of cryptographic keys used in vendor-specific encrypted communications. The issue results from the lack of proper initialization of a variable prior to accessing it. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26295. |
| Link | Providers |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-25-328/ |
|
Thu, 14 Aug 2025 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Wolfbox
Wolfbox level 2 Ev Charger Wolfbox level 2 Ev Charger Firmware |
|
| CPEs | cpe:2.3:h:wolfbox:level_2_ev_charger:-:*:*:*:*:*:*:* cpe:2.3:o:wolfbox:level_2_ev_charger_firmware:3.1.17:*:*:*:*:*:*:* |
|
| Vendors & Products |
Wolfbox
Wolfbox level 2 Ev Charger Wolfbox level 2 Ev Charger Firmware |
|
| Metrics |
cvssV3_1
|
Fri, 06 Jun 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 06 Jun 2025 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of cryptographic keys used in vendor-specific encrypted communications. The issue results from the lack of proper initialization of a variable prior to accessing it. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26295. | |
| Title | WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability | |
| Weaknesses | CWE-457 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: zdi
Published:
Updated: 2025-06-06T15:53:57.850Z
Reserved: 2025-06-05T20:45:30.134Z
Link: CVE-2025-5749
Vulnrichment
Updated: 2025-06-06T15:53:55.278Z
NVD
Status : Analyzed
Published: 2025-06-06T16:15:30.120
Modified: 2025-08-14T15:37:47.553
Link: CVE-2025-5749
Redhat
No data.
OpenCVE Enrichment
No data.