Siemens VersiCharge AC Series EV Chargers Modbus Default Enablement Vulnerability Allowing Remote Control

A vulnerability exists in Siemens VersiCharge AC Series EV Chargers, specifically in various IEC and UL Commercial models, all versions prior to V2.135. The issue arises from the Modbus service being enabled by default, which could permit an attacker connected to the same network to remotely control the EV charger.

Impact

Exploitation of this vulnerability could lead to unauthorized remote control of the affected EV charger.

Remediation

Siemens recommends protecting network access to affected products with appropriate security measures. For specific product remediations or mitigations, refer to the Siemens Security Advisory SSA-556937.