WOLFBOX Level 2 EV Charger Heap-Based Buffer Overflow Remote Code Execution Vulnerability

A heap-based buffer overflow vulnerability allowing remote code execution has been identified in the WOLFBOX Level 2 EV Charger. This issue arises in the tuya_svc_devos_activate_result_parse function, where the secKey, localKey, stdTimeZone, and devId parameters are improperly validated before being copied to a fixed-length heap-based buffer. As a result, network-adjacent attackers can execute arbitrary code on the affected device without requiring authentication.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device.

Remediation

The advisory suggests restricting interaction with the product as a mitigation strategy.