CVE-2025-12357
Medium · 6.3CVSS
6.3
EPSS
0.8%
Published
Oct 31, 2025
CISA due date
—
The record
By manipulating the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements, an attacker can stage a man-in-the-middle attack between an electric vehicle and chargers that comply with the ISO 15118-2 part. This vulnerability may be exploitable wirelessly, within close proximity, via electromagnetic induction.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-81871 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-923
- CVE-2026-57028 An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in… CWE-923
- CVE-2026-33803 An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in… CWE-923
- CVE-2026-55655 A flaw was found in OpenSSH. CWE-923
- CVE-2026-12539 Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at… CWE-923
- CVE-2026-12039 Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to… CWE-923
- CVE-2025-36145 IBM watsonx.data 2.2 through 2.3.1 IBM Lakehouse does not properly restrict inbound and… CWE-923
- CVE-2026-22726 Route Services can be leveraged to send app traffic to network destinations outside of an… CWE-923