# Three Critical Memory Corruption Bugs Expose ABB EV Chargers to Firmware Hijacking Attacks
## The Threat
ABB's Terra AC Wallbox—a globally deployed electric vehicle charging system used in commercial and infrastructure environments—contains three distinct buffer overflow vulnerabilities that collectively allow attackers to corrupt heap, stack, and BSS memory segments. The flaws, disclosed as CVE-2025-10504, CVE-2025-12142, and CVE-2025-12143, affect all Japanese market variants through firmware version 1.8.33 and represent a chain of memory safety failures in critical energy infrastructure.
The vulnerabilities stem from insufficient input validation in three separate code paths: one affecting developers building custom applications that communicate with the charger via a proprietary protocol, another in Bluetooth firmware binary file handling, and a third in the OCPP (Open Charge Point Protocol) backend configuration. None of these flaws require external network access, but together they illustrate a troubling pattern in IoT device security—the assumption that encrypted communication channels are sufficient protective layers.
The most direct attack vector involves Bluetooth interception. While ABB notes that Bluetooth messages are encrypted, the advisory makes clear that successful exploitation requires an attacker to first compromise the Bluetooth link itself. Once the wireless channel is hijacked, all three vulnerabilities become exploitable, potentially allowing an attacker to write arbitrary data to the device's flash memory and alter its firmware behavior. For a critical charging infrastructure component deployed worldwide, this represents a significant supply-chain and grid-reliability concern.
## Severity and Impact
| CVE | CVSS v3.1 | Vector String | Attack Vector | Attack Complexity | Authentication | Impact |
|---------|---------------|------------------|-------------------|----------------------|-------------------|-----------|
| CVE-2025-10504 | 6.1 (MEDIUM) | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H | Adjacent Network | Low | High (admin) | Heap memory corruption; firmware modification |
| CVE-2025-12142 | 6.1 (MEDIUM) | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H | Adjacent Network | Low | High (admin) | BSS memory pollution; firmware modification |
| CVE-2025-12143 | 6.1 (MEDIUM) | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H | Adjacent Network | Low | High (admin) | Stack memory overflow; firmware modification |
CWE References:
## Affected Products
ABB Terra AC Wallbox (Japan Market)
The advisory specifically lists the Japanese market variant, though the Terra AC Wallbox product family is deployed globally. Organizations using other regional variants or different ABB charging solutions should verify compatibility with the patched firmware version 1.8.36 through their local ABB representative.
## Mitigations
Immediate Actions:
1. Firmware Update: ABB recommends all customers apply the 1.8.36 update at the earliest convenience. This patch addresses all three buffer overflow conditions across heap, stack, and BSS memory regions.
2. Bluetooth Network Segmentation: Implement strict wireless network boundaries around charger installations. Disable unnecessary Bluetooth pairing, maintain physical access controls, and monitor for unauthorized Bluetooth connection attempts.
3. Protocol Hardening for Custom Applications: Organizations that have developed proprietary applications communicating with the charger using ABB's self-defined protocol must conduct code audits to ensure strict field-length validation. Do not assume the firmware will reject malformed messages—validate at the application layer.
4. OCPP Configuration Audit: Review backend configuration for OCPP parameters, particularly the "RandomDelay" field. Verify that all numeric inputs conform to expected ranges and data types; restrict administrative access to configuration interfaces.
5. Wireless Security Monitoring: Deploy Bluetooth scanning tools in charging infrastructure networks to detect unauthorized or rogue devices attempting to establish connections. Alert on unexpected MAC addresses or connection patterns.
6. Firmware Integrity Verification: Implement periodic firmware integrity checks on deployed chargers if supported by ABB's management platform. This may catch unauthorized firmware modifications if they occur despite other mitigations.
## References
## HackWire Analysis
These three vulnerabilities expose a recurring blind spot in critical infrastructure security: the belief that encryption alone provides adequate protection. ABB's own advisory states that because Bluetooth messages are encrypted, "there is no way to attack the charger"—yet the existence of these CVEs confirms otherwise. The assumption conflates *channel security* with *application security*. A compromised or hijacked Bluetooth connection bypasses encryption entirely, leaving the application layer to fend for itself against malformed inputs.
The geographic specificity—these bugs affect Japanese market variants—raises questions about how firmware variants diverge across regions. Are other ABB Terra AC products deployed in North America, Europe, or Asia-Pacific similarly affected by related bugs that haven't yet surfaced? Buffer overflow vulnerabilities rarely exist in isolation; they often indicate a systemic lack of input validation practices across a codebase.
More broadly, this disclosure reflects a troubling reality in the EV charging ecosystem: infrastructure providers often inherit legacy protocols and communication patterns optimized for cost rather than security. The proprietary protocols referenced in CVE-2025-10504, the firmware binary handling in CVE-2025-12142, and the OCPP backend misconfiguration in CVE-2025-12143 all point to systems where security hardening was retrofitted rather than built in from the start.
For utilities and charging network operators worldwide, the mitigation guidance hinges on firmware deployment velocity. With 1.8.36 available, organizations must prioritize patching Terra AC installations in populated areas or connected to critical load-balancing circuits. The firmware write capability these vulnerabilities enable could allow attackers to suppress charging requests, alter power distribution, or inject malicious behavior into the grid-connected device ecosystem—a foothold attackers value far more than stealing individual charging sessions.
— HackWire Editorial
## Related Coverage