WOLFBOX Level 2 EV Charger Authentication Bypass Vulnerability via Uninitialized Variable in BLE Encryption Key Handling

An authentication bypass vulnerability has been identified in WOLFBOX Level 2 EV Charger devices. This issue arises from an uninitialized variable in the management of cryptographic keys used for vendor-specific encrypted communications. As a result, network-adjacent attackers can exploit this vulnerability to bypass authentication on the affected chargers, without the need for prior authentication.

Impact

Exploitation of this vulnerability allows for authentication bypass on the affected EV chargers.

Remediation

The recommended mitigation strategy is to restrict interaction with the affected WOLFBOX Level 2 EV Charger.