One Modem to Brick Them All -Vulns in EV Charging Comms
Discloses vulnerabilities in QCA 7000 HomePlug modems used across CCS and NACS EV charging systems that enable communication hijacking and denial of service.
Summary
Power-Line Communication in EV Charging Systems
Electric Vehicle (EV) charging systems rely on Combined Charging System (CCS) and North American Charging Standard (NACS) protocols, which utilize HomePlug Green PHY power-line communication (PLC) for vehicle-to-grid data exchange.
Vulnerabilities in the QCA 7000 Modem Series
Jan Berens and Marcell Szakaly analyze the widely used Qualcomm QCA 7000 modem series, uncovering multiple critical vulnerabilities in PLC message processing and firmware execution.
Remote Communication Hijacking and Denial of Service
Exploiting flaws in HomePlug link negotiation allows attackers to intercept charging session telemetry at a distance, inject spoofed control commands, or trigger persistent denial-of-service conditions that prevent vehicle charging.
Firmware Reverse Engineering and Code Execution
Reverse engineering the QCA 7000 firmware revealed memory corruption vulnerabilities enabling arbitrary code execution on the modem hardware, highlighting urgent security needs across global EV charging infrastructure.
Related talks
Main Stage·55 min
Jan Berens · Marcell Szakály · Sebastian Köhler
Discloses vulnerabilities in QCA 7000 HomePlug modems used across CCS and NACS EV charging systems that enable communication hijacking and denial of service.
Creator Stage·43 min
Zoltan Balazs
Surveys pervasive architectural and implementation failures in consumer IoT gadgets, highlighting cleartext credentials, command injections, and insecure defaults.
Creator Stage·26 min
Alexandru Lazar
Demonstrates remote code execution vulnerabilities in popular Dahua perimeter surveillance cameras discovered through firmware key extraction.