Vulnerability in ID Charger Connect and Pro from Volkswagen Group Charging GmbH – Elli, EVBox versions SPR3.2B, SPR3.51 and SPR3.52

PCAutomotive team has identified a vulnerability that allows an attacker having access to the private network to which the charger is connected, or with local access to the Ethernet interface, to bypass password authentication in the web configuration interface of ID Charger Connect and Pro versions SPR3.2B, SPR3.51 and SPR3.52 due to a faulty implementation of the JWT library. In this level of access, an attacker can:

• Enable and disable Wi-Fi, Ethernet, and LTE interfaces of the charger.

• Initiate a factory reset causing a short-term denial-of-service of the charger, settings reset and disconnect from the owner’s Wi-Fi network.

• Enumerate available Wi-Fi networks SSIDs at charger’s location.

• Obtain system information, such as components serial numbers, software versions, mac addresses of charger interfaces, etc.

• Manage user preferences