PlaxidityX researchers have disclosed a critical stack-based buffer overflow vulnerability in the open-source implementation of the Signal Level Attenuation Characterization protocol used in EV charging communication. Tracked as CVE-2025-27071, the flaw resides in the open-plc-utils toolkit that implements the SLAC protocol defined by ISO 15118 and DIN SPEC 70121.
Both electric vehicles and charging stations are affected. The vulnerability allows an attacker to trigger arbitrary code execution by sending a crafted packet where the “Number of Groups” field is not validated before being used in a memcpy operation, creating a stack-based buffer overflow.
The SLAC protocol ensures reliable Powerline Communication between EVs and charging stations, handling the handshake process before IP communication begins. The open-plc-utils project provides tools for interacting with Qualcomm Atheros Powerline chips, making the vulnerable code present in many charging station implementations that run on Linux.
PlaxidityX reported the issue to Qualcomm in December 2024, leading to a security advisory in August 2025 and a subsequent patch. The vulnerability was found in both the EV side and the charging station side of the protocol implementation.
As EV adoption grows alongside Vehicle-to-Grid integration, securing protocol implementations becomes critical. This finding highlights the need for rigorous memory-safety validation in charging infrastructure firmware, where a single unvalidated byte can cascade into full system compromise.
