EV-charging threat record
Public advisories, research and incidents that matter to charge point operators, each with its source and what it means in practice.
Read this first
- We found no verified mass charger outage, grid effect or attack on an EU charge point operator.
- CISA reported no known public exploitation on the advisories we checked.
- BSI says public evidence doesn’t support a complete picture of the situation.
- So this record is mostly vulnerabilities and research. Treat it as exposure, and don’t read it as a count of attacks.
The ten entries that matter most
| Date | What happened | What it means in practice | Source |
|---|---|---|---|
| Jan to Oct 2026 | CISA issued at least 15 advisories on EV-charging back-ends. The six from 26 February all list missing authentication on charger connections. | Check whether a charger can connect using only a publicly visible ID. | CISA, ICSA-26-057-03 |
| May to Jul 2026 | Germany’s BSI published a report on public charging and a position paper. The paper proposes OCPP 2.0 or later with at least Security Profile 2. | Germany’s cybersecurity agency now proposes a baseline that buyers can quote. | BSI position paper |
| Mar 2026 | Charger maker ELECQ reported ransomware in its cloud. Customer contact data, including home addresses, may have been copied. Chargers were reportedly unaffected. | A supplier’s cloud breach can become your customers’ privacy problem. | The Register (secondary) |
| Jan 2026 | A 50 kW DC charger, the Alpitronic HYC50, was exploited at Pwn2Own Automotive. This was a contest under coordinated disclosure, and not a field attack. | DC assets are now tested targets, along with wallboxes. | ZDI, day one results |
| May 2026 | CISA republished ABB’s advisory on Terra AC wallboxes, where a crafted OCPP message causes memory corruption (CVE-2025-5517). It needs a hijacked back-end or an unencrypted link. | The back-end channel can harm the charger. Retire unencrypted links. | CISA, ICSA-26-146-01 |
| 2025 | A USENIX Security study of 325 DC chargers in four countries found that 12% supported TLS on the vehicle-to-charger link. None supported ISO 15118-20 or mutual TLS. | An “ISO 15118 capable” label doesn’t mean the link is encrypted in the field. | Szakály et al., USENIX Security |
| 2024 | Researchers reported six zero-days across 16 live OCPP back-ends. | Back-end flaws are systemic, so test yours. | Sarieddine et al., AsiaCCS |
| 2023 | Brokenwire showed CCS charging sessions aborted by radio at up to 47 m, using under 1 W, across 8 vehicles and 20 chargers. | Radio interference can stop charging, and a back-end patch doesn’t fix it. | NDSS 2023 |
| 2022 | A Sandia-led review mapped disclosed charging vulnerabilities. | Government labs have documented this attack surface for years. | Energies 15(11) |
| Feb 2022 | Chargers on Russia’s M11 motorway were disabled and showed political messages. A supplier backdoor was alleged, and accounts conflict. | Supplier remote access belongs on your risk register. | Vice (secondary) |
CISA advisories on charging back-ends in 2026
At least 15 so far. This list is what we found, and CISA’s full index may hold more. Each link gives the affected product and the vendor’s response.
| Month | Advisories |
|---|---|
| Jan | 1 |
| Feb | 6 |
| Mar | 5 |
| Apr | 0 |
| May | 0 |
| Jun | 1 |
| Jul | 1 |
| Aug | 0 |
| Sep | 0 |
| Oct | 1 |
What the 26 February advisories have in common
All six list the same four weaknesses. CISA scores the first one 9.4 on CVSS.
Missing authentication on the charger connection
No limit on authentication attempts
Weak session handling, so one ID can hold two connections
Charger identifiers visible on public maps
Pwn2Own Automotive results
Contest totals from ZDI’s results posts. Charger counts are our own tally of entries and rewarded entries. They count attempts rather than bugs.
| Year | Zero-days, all categories | Awarded | Charger entries / rewarded | Source |
|---|---|---|---|---|
| 2024 | 49 | $1,323,750 | 30 / 23 | ZDI results |
| 2025 | 49 | $886,250 | 24 / 20 | ZDI results |
| 2026 | 76 | $1,047,000 | 35 / 30 | ZDI results |
Scale and readiness
EU27 public recharging points, reference month September 2026, preliminary. EAFO, October 2026 update
About 91% of OCPP-certified products are certified for version 1.6 and about 9% for 2.0.1, in BSI’s 2026 report, using Open Charge Alliance data from August 2025. BSI report on public charging
Share of those products that also hold a security certificate. BSI report on public charging
Figures we don’t use
These circulate in market content. We left them out because we couldn’t trace them or because they’re often misapplied.
Attributed to ENISA on a market-research page. We couldn’t trace it to an ENISA report.
From a vendor blog, with no method we could check.
The study covers the vehicle-to-charger link on 325 DC chargers, and says nothing about OCPP.
How exposed is your network?
A free health check shows which of these weaknesses apply to you. Spotted an error on this page? Tell us and we’ll correct it.
Request a free health check