Peril at the Plug: Investigating EV Charger Security and Safety Failures

Overview: Jonathan Anderson and Thanos present an in-depth security and physical safety analysis of Level 2 Electric Vehicle Supply Equipment (EVSE / EV chargers) at Black Hat. Reviewing vulnerability trends and exploits from Pwn2Own automotive contests, the researchers demonstrate how software and firmware compromises allow adversaries to manipulate electrical charging protocols. Through rigorous empirical testing on a custom 27.5 kW resistive load bank, the speakers reveal the catastrophic physical consequences of EVSE compromise, including cable meltdowns, violent arc flashes, toxic vapor explosions, and circuit breaker bypasses.

Key Topics: - EVSE embedded system architecture, wireless attack surfaces, and Pwn2Own bug classes - SAE J1772 Control Pilot protocol manipulation via pulse-width modulation (PWM) - Custom high-power load bank testing rig and hardware-level safety bypasses - Thermal runaway dynamics, cable insulation failure, arc flashes, and explosive off-gassing

Technical Details: The presenters examine the dual-processor architecture common to modern EV chargers, consisting of an application processor running Linux or RTOS managing Wi-Fi, Bluetooth, mobile apps, and cloud telemetry, and a secondary microcontroller governing the high-voltage relay and charging signaling. Evaluating Pwn2Own 2024 and 2025 findings, they note prevalent memory safety vulnerabilities (CWE-120, CWE-121, CWE-122) and an absence of basic exploit mitigations. Notable exploits reviewed include Synactive's CAN-bus firmware downgrade of the Tesla Wall Connector using a Raspberry Pi to expose root-accessible debug services; Synactive's Autel charger attack exploiting an unconstrained USB setup packet out-of-bounds write behind an Allen-key access port; and Wolfbox chargers vulnerable to cloned Mifare Classic 1K RFID cards, which reset devices fleet-wide to factory states and facilitate flashing unsigned, encrypted malicious firmware.

The core research investigated how cyber compromises translate into severe physical destruction using the SAE J1772 Level 2 charging standard. The charging rate is governed by the Control Pilot (CP) pin, which transmits a 1 kHz pulse-width modulated (PWM) signal where duty cycle commands vehicle current draw (10% for 6A up to 96% for 80A). To evaluate hardware tolerances when software safeties are neutralized, the researchers constructed a 27.5 kW load bank utilizing remote Wi-Fi circuit breakers and industrial heating elements. They modified test chargers by lifting the processor pin controlling the main relay and attaching external jumper harnesses, forcing chargers to deliver continuous 80A loads well beyond their manufacturer ratings.

During sustained 80A testing, charging cables rapidly experienced thermal runaway, adhering to the square-law relationship ($I^2R$) where doubling current quadruples heat output. Cable temperatures exceeded 340°F (171°C), melting wall brackets and liquefying internal insulation. Melting caused internal conductors to short, triggering violent arc flashes that ejected molten copper jets and ignited toxic, flammable off-gassed polymer vapors in concussive explosions. In multiple units, high-voltage current shorted into the low-voltage Control Pilot circuit, vaporizing pilot hardware and threatening severe damage to vehicle electronic control units (ECUs). Standard 60A upstream thermal-magnetic circuit breakers failed to prevent this destruction, as electrical code-mandated 125% breaker oversizing (a 60A breaker on a 48A charger) combined with standard thermal tripping delays allowed chargers to operate at 41% overcurrent indefinitely.

Key Takeaways: EV charger manufacturers must implement independent, hardware-level secondary safety mechanisms—such as non-resettable thermal fuses and isolated overcurrent sensors—that cut power autonomously if software or firmware is compromised. Consumers and electricians must never oversize circuit breakers beyond code specifications, uncoil charging cables fully over bare concrete, and avoid storing coiled cables beneath charging units. Automotive engineers must harden onboard vehicle charging controllers against high-voltage surges resulting from shorted EVSE Control Pilot lines.

(AI summary — Gemini Flash)