VulnSocial

CVE-2025-12357Exploit

LOWCVSS 5.3 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

By manipulating the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements, an attacker can stage a man-in-the-middle attack between an electric vehicle and chargers that comply with the ISO 15118-2 part. This vulnerability may be exploitable wirelessly, within close proximity, via electromagnetic induction.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-923

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • Exploit tooling references are present in monitored signal
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-02-20); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-02-20: 1Mentions · 2026-03-31: 1Exploit Tool / Code · 2026-02-20: 1Technical Details · 2026-02-20: 1Technical Details · 2026-03-31: 102-2003-31
Signal classification2 categories
Exploit
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-02-201
Exploit1
2026-03-311
Disclosure1
Full discourse2 posts
  • Sébastien Dudek 📡@FlUxIuS
    Exploit

    POV: you demo a vulnerability on stage in 2019, release a full exploitation tool (V2GInjector), present it at conferences and then get silent for some years... ...and in 2025 it finally gets a CVE because someone else reported it to CISA 💀 At least they credited us with JC Delaunay and @Karion_. Thanks CISA 🤝 CVE-2025-12357 — SLAC MitM on ISO 15118-2 EV charging. CVSS 8.3. AKA "the HPGP standard is broken by design, we told you so." https://www.cve.org/CVERecord?id=CVE-2025-12357

    Post summary

    The passage announces CVE-2025-12357, a MitM vulnerability in ISO 15118-2 EV charging, noting a previously demonstrated tool V2GInjector and a CVSS score of 8.3, but it offers no active exploitation or patch information.

    1402842.3K
    3.7K followersView on X
  • ThreatCluster@threatcluster
    Disclosure

    BREAKING: New EV charger flaw CVE-2025-12357 in ISO 15118 SLAC pairing exposes home wallboxes to eavesdropping, MiTM and billing fraud over power line communication. https://threatcluster.io/cluster/vulnerabilities-in-ev-chargers-expose-consumers-to-cyber-thr-83d91d12

    Post summary

    A newly disclosed CVE‑2025‑12357 flaw in EV charger ISO 15118 SLAC pairing allows eavesdropping, man‑in‑the‑middle attacks, and billing fraud over power‑line communication, exposing home wallboxes to potential exploitation.

    00000231
    128 followersView on X

Explore more

Back to dashboard