WOLFBOX Level 2 EV Charger tuya_svc_devos_activate_result_parse secKey/localKey/stdTimeZone/devId heap-based overflow

Summaryinfo

A vulnerability, which was classified as critical, was found in WOLFBOX Level 2 EV Charger. This affects the function tuya_svc_devos_activate_result_parse. Executing a manipulation of the argument secKey/localKey/stdTimeZone/devId can lead to heap-based overflow. This vulnerability is tracked as CVE-2025-5750. The attack is only possible within the local network. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in WOLFBOX Level 2 EV Charger (affected version not known). This vulnerability affects the function tuya_svc_devos_activate_result_parse. The manipulation of the argument secKey/localKey/stdTimeZone/devId with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

WOLFBOX Level 2 EV Charger tuya_svc_devos_activate_result_parse Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WOLFBOX Level 2 EV Charger. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the secKey, localKey, stdTimeZone and devId parameters. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26294.

The advisory is shared for download at zerodayinitiative.com. This vulnerability was named CVE-2025-5750 since 06/05/2025. The exploitation appears to be easy. The attack can only be initiated within the local network. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-17314). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• WOLFBOX

Name

• Level 2 EV Charger

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion