▶ Watch (1:45)

DC chargers use powerline communication (PLC) on the charging cable. The standard defines an IPv6 setup after a low-level handshake. The researchers built an EV emulator box with a Raspberry Pi, a QCA7000 modem, and a custom PCB. Over one week they drove across four European countries and collected data from 697 CCS plugs. The box runs the same protocols as a real EV. The source code is public on GitHub.

Found: Two Chips, One Decade-Old Firmware

▶ Watch (6:38)

All chargers use either the QCA7000 or QCA7005 chip. The researchers could read the chip version and firmware version by sending a command over the PLC link. Over half the chargers run firmware from 2013 or 2015. None had firmware newer than 2022. The broken wire attack, disclosed in 2022, remains unpatched on every device tested.

PIB Buster: Remote Configuration Override

▶ Watch (12:34)

Each modem stores settings in a Parameter Information Block (PIB). The PIB contains the MAC address, network key, and security settings. It can be read and written over Ethernet. The researchers found that the same write command works across the PLC link — a rogue EV can overwrite the charger’s PIB and vice versa. By comparing a secure and a vulnerable PIB, they located the security bit at offset 0x1F8C. Setting it to 1 blocks remote writes. Setting it to 0 allows them.

California Road Test: 41 of 69 Chargers Vulnerable

▶ Watch (17:54)

They visited 69 chargers in California and read the PIB from 41. All 41 had the security bit set to 0. Reading was always safe. They assumed that if read was blocked the device was secure. The 41 chargers included multiple major brands. The researchers disclosed the issue to Qualcomm in February 2025. Qualcomm acknowledged the vulnerability and said it would be fixed.

Reset Bypass, Ground Attacks, and Doom

▶ Watch (21:25)

Even with the security bit enabled, sending a reset command clears it. After reset the chip falls back to a factory default that allows writes. This works on modems with external flash, but not on host‑booted designs where the configuration is reloaded on every boot. For the latter, denial of service is still possible until reboot. The researchers also demonstrated that a simple wire connected to building ground can sniff or jam the PLC signal. They got Doom running on the modem by overwriting the flash with custom code, using UDP for keyboard and mouse input.

Notable Quotes

we found that all of the modems we or all of the chargers we could test uh for some reason you can actually ask it for the specific chip version of the communication chip and also the firmware Marcell Szakály · ▶ 06:38

we stole a page out of the kind of uh attack that some of these CPU side channels also used where we take the data that we want to send and we actually treat it as a memory address Marcell Szakály · ▶ 34:49

we should keep PLC where it belongs in your home network. Not for industrial devices, not for critical infrastructure. In my opinion, it’s broken beyond repair. Jan “SP3ZN45” Berens · ▶ 42:02

Key Takeaways

  • Over half of CCS chargers run powerline modem firmware from 2013 or 2015.
  • A single bit in the configuration file controls remote write protection — and it’s often disabled.
  • Attackers can bypass the security bit by sending a reset command.
  • Ground-based attacks require no physical cable contact beyond a nearby ground connection.
  • The researchers demonstrated full custom code execution on the QCA7000, including running Doom.

About the Speaker(s)

Marcell Szakály is a PhD student in the Systems Security Lab at the University of Oxford. His research focuses on the security of the EV charging infrastructure. He received his masters degree in Physics, and worked on superconducting magnet design. His work now involves RF hardware, SDRs, and digital electronics.

Jan Berens aka SP3ZN45 has been a goon in the QM department for several years now and is working full time as a redteamer at alpitronic SLR the leading manufacturer for DC chargers in Europe. His background is security consulting and penetration testing for critical infrastructures and industrial installations in Europe. Doing mostly non publicly disclosed security research and mentoring of beginners in the security domain.