Overview
The vulnerability CVE-2025-31930 is a critical security flaw that affects a wide range of electric vehicle (EV) chargers. It notably impacts IEC and UL Commercial series chargers, potentially exposing a large customer base to significant risk. The vulnerability lies within the Modbus service, which is enabled by default on these devices. As this service is not secured properly, it could allow an attacker within the same network to remotely control the EV charger. This vulnerability is particularly alarming due to the increasing reliance on EV chargers worldwide, making it a pressing issue that requires immediate attention.
Vulnerability Summary
CVE ID: CVE-2025-31930
Severity: High (8.8 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Remote Control of EV Chargers, Potential System Compromise or Data Leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Due to the length of the list, only a subset of the affected products is shown below. For the complete list, refer to the official CVE description.
Product | Affected Versions
IEC 1Ph 7.4kW Child socket | All versions < V2.135 IEC 1Ph 7.4kW Child socket/ shutter | All versions < V2.135 IEC 3Ph 22kW Child cable 7m | All versions < V2.135 UL Commercial Child 48A BA Compliant | All versions < V2.135 UL Commercial Parent 48A with Simcard BA | All versions < V2.135 How the Exploit Works
The Modbus service, which is enabled by default on the affected EV chargers, lacks appropriate security measures to prevent unauthorized access. An attacker connected to the same network could exploit this flaw by sending specially crafted requests to gain control over the EV charger. The attacker could potentially alter the charging process, steal sensitive information, or harm the connected EV.
Conceptual Example Code
The following conceptual exploit illustrates a potential attack scenario. This pseudocode details how an attacker might send a malicious payload to the Modbus service:
import modbus
# Connect to the Modbus service
service = modbus.connect("target_IP_address")
# Send malicious commands
service.send("malicious_command")Please note that the above is a conceptual example and won’t work in a real-world scenario. It is provided for illustrative purposes only.