Introduction
Session hijacking and billing fraud are now practical threats for electric vehicle charging networks that use ISO 15118-2. CVE-2025-12357 is a protocol-level flaw that lets an attacker in close proximity intercept or manipulate a charging session before any cryptographic protection is in place. It directly affects the integrity and trustworthiness of public and fleet EV charging infrastructure.
ISO 15118-2 is an international standard for communication between electric vehicles and charging stations. EVSE (Electric Vehicle Supply Equipment) makers and vehicle manufacturers have adopted it widely around the world, and modern smart charging networks are built on it. The SLAC (Signal Level Attenuation Characterization) protocol is a core part of the standard. It handles the physical association between a vehicle and a charger over powerline communication.
Technical Information
The vulnerability is in the SLAC protocol, which handles the initial physical pairing between an electric vehicle and a charging station over HomePlug Green PHY powerline communication. During the SLAC process, the vehicle (EVCC) sends sounding messages to test the communication channel. The charger (EVSE) replies with attenuation measurements, and the vehicle uses those measurements to pick the charger to pair with.
SLAC does not authenticate or encrypt these messages. Because of that design choice, any device on the same powerline segment, or within electromagnetic coupling range, can inject spoofed SLAC responses. An attacker can craft responses with manipulated attenuation values so that the vehicle associates with an attacker-controlled device instead of the legitimate charger. The attacker then holds a man-in-the-middle position before any higher-layer security, such as TLS, is negotiated.
The root cause is in the protocol design. SLAC does not restrict communication to intended endpoints, and it does not verify that attenuation measurements are authentic (CWE-923). From that position, the attacker can intercept, modify, or inject messages for the rest of the charging session, which could mean capturing credentials, altering billing data, or disrupting charging.
Exploitation requires physical proximity to the charging infrastructure. An attacker can get there by connecting to the same powerline segment or, in some scenarios, by using specialized hardware to inject signals wirelessly through electromagnetic induction. The wireless route is less documented, but the advisory still flags it as a theoretical risk.
As of the advisory date, there were no public code snippets or exploit scripts for this vulnerability.
Affected Systems and Versions
Every implementation of ISO 15118-2 that uses the SLAC protocol for EV to EVSE pairing is affected. This includes:
- Any EVSE (charging station) or vehicle supporting ISO 15118-2 SLAC pairing
- All firmware and software versions implementing the protocol as specified
- Both public and private charging deployments using HomePlug Green PHY
No vendor-specific or version-specific exclusions have been identified. The flaw is inherent to the protocol design, not to a particular product or firmware version.
Vendor Security History
Because the vulnerability is in the protocol, it affects the whole ISO 15118-2 ecosystem. Previous research has documented uneven adoption of security best practices among EVSE vendors, including slow TLS rollout and weak key management in some implementations. The industry has a mixed record on timely patching, especially for embedded and long-lifecycle infrastructure. No single vendor is uniquely responsible for this issue.
