The Hidden CCS2 Attack Surface on EV Chargers
Partners
Blog
About
Contact
Blog<br>The Hidden CCS2 Attack Surface on EV Chargers
The Hidden CCS2 Attack Surface on EV Chargers
and<br>Lionel Richard Saposnik
Jun 2026
Share on Facebook
Share on LinkedIn
Share on X
TL;DR (CVE-2026-9039)<br>An EV charger's charging port is a network port. We found SSH and Telnet services exposed on XCharge C6 chargers with default root:root credentials . A threat actor with a malicious EV can gain immediate full control access on the charger and perform energy theft or potentially cause physical damage.
Scenario<br>Business Impact
Fleet compromise<br>Backdoors installed across the charging network
CPO network breach<br>Lateral movement via charger backbone connectivity
Safety incident<br>Power and thermal parameter manipulation
Supply chain attack<br>Compromised charger infects connecteding EVs
What we found:<br>SSH/Telnet bound to all interfaces (0.0.0.0)<br>Default credentials: root:root<br>No authentication hardening (rate limiting, lockout)<br>Pattern likely exists across multiple vendors<br>Bottom line: Plug in, SSH in, you're root.<br>Executive Summary<br>The Overlooked Attack Surface<br>The EV charging industry has well-established security standards. OCPP (Open Charge Point Protocol) provides clear guidelines for securing the communication channel between EV Chargers and the Charging Station Management System (CSMS): use VPNs or Private APNs, implement OCPP Security Profile 2 or higher, enforce TLS mutual authentication etc. When properly configured, these measures make it significantly harder for threat actors to compromise the management channel.<br>But what about the other side of the charger?<br>While the industry has focused on securing the backend communication, the attack surface exposed through the CCS2 charging plug remains largely untested.<br>Every time an EV connects to a charger, it establishes an IP network over Power Line Communication (PLC). This network was designed for V2G protocols. But we also discovered other EV charger operating system services listening on these network interfaces.<br>Why This Matters<br>From a traditional IT security perspective, think of this attack vector as analogous to an attacker having a port in the corporate LAN. The scenario is identical, except the port isn't an RJ45 jack in the office, it's a CCS2 connector in a parking lot.<br>This has profound implications: compromised EV chargers can serve as a foothold into CPO (Charge Point Operator) private networks. Since chargers often connect to backend systems via VPN or Private APN infrastructure, an attacker with access to a charger could potentially pivot to back-office systems, billing platforms, or other critical infrastructure.<br>The Finding<br>We discovered that the XCharge C6 charger exposes administrative services (SSH and Telnet) on all network interfaces, including the PLC interfaces accessible from connected EVs. Combined with the trivial password root for the user root, provides immediate privileged user access to anyone who can plug into the charging port.
What Can a Threat Actor Do?<br>Once an attacker gains full control on the charger's DCB, the described below primary attack scenarios emerge:
The full breakdown is shown in our previous blog covering SLAC protocol exploit to gain RCE.<br>The Attack Surface: CCS2 as a Network Interface<br>Most people think of the CCS2 charging plug as just a power connector. It's not. It's also a network interface.<br>When an EV plugs in, the charger and vehicle establish an IPv6 network link over the charging cable using HomePlug Green PHY (powerline communication). This network is intended for V2G charging protocols - but any service listening on all interfaces becomes accessible.<br>The bottom line: Plug in a CCS2 device → Get an IPv6 address → Access any exposed service .<br>The Vulnerability: Exposed Administrative Services<br>Our reconnaissance revealed the following listening services on the DCB of XCharge C6:
The DCB has multiple network interfaces : (addresses are masked with `?`)
Interface<br>Purpose<br>Accessible from EV
can0<br>CAN bus (internal)<br>No
eth0<br>Management network<br>No
lo<br>Loopback<br>No
qca0<br>PLC modem - CCS2 Gun 1<br>YES
qca1<br>PLC modem - CCS2 Gun 2<br>YES
When a service binds to 0.0.0.0 or [::], it listens on every network interface - including:<br>CCS2 (PLC) interfaces (qca0, qca1) accessible from the connected EV<br>Internal management interface (eth0)<br>What Services Are Exposed?
Service<br>Port<br>Purpose<br>Should Be Exposed to EV?
SSH (Dropbear)<br>22<br>Remote administration<br>NO - Misconfiguration
Telnet (BusyBox)<br>23<br>Remote administration<br>NO - Misconfiguration
V2G (SECC)<br>15118<br>ISO 15118 / DIN 70121 charging protocol<br>Yes - Required for charging
The Vulnerability: Default Credentials<br>The root account uses a trivially weak password: root<br>This is one of the most common default passwords in embedded systems, and it was never changed before deployment.<br>No Authentication Hardening:<br>No rate limiting on login attempts<br>No account lockout after failed attempts<br>No...