The hum of an electric vehicle charging at a public station has become the soundtrack of urban sustainability, but beneath this quiet revolution lies a complex web of digital vulnerabilities that could compromise more than just your commute. Siemens Energy's VersiCharge series, a prominent player in the rapidly expanding EV infrastructure market, faces newly disclosed security flaws that expose critical weaknesses in our electrified future. Designated as CVE-2025-31929 and CVE-2025-31930, these vulnerabilities reveal systemic challenges in securing operational technology (OT) environments where physical infrastructure intersects with digital networks. As charging stations evolve into networked energy nodes, their role extends beyond refueling vehicles—they're becoming potential entry points for disrupting power grids, manipulating energy markets, and compromising user data.

Anatomy of the Exposures

Technical analysis of the CVEs, cross-referenced with Siemens' security advisories and industrial control system (ICS) vulnerability databases, reveals two distinct attack vectors:

  • CVE-2025-31929: A critical authentication bypass (CVSS 9.1) in the Modbus TCP protocol implementation allowing unauthenticated command execution. Modbus, the 1979-originated industrial communication standard still widely used in EV chargers, wasn't designed for modern threat landscapes. Exploitation enables attackers to remotely manipulate charging parameters, disable safety protocols, or force overcurrent conditions that could damage vehicles or infrastructure. ICS-CERT confirms similar Modbus vulnerabilities have increased 47% year-over-year since 2023.

  • CVE-2025-31930: A high-severity memory corruption flaw (CVSS 7.8) in the firmware update mechanism. During staged updates, improper boundary checks allow buffer overflow attacks that could install persistent malware. This is particularly concerning given Siemens' "Secure Firmware Update" architecture, which ironically becomes the attack surface. Energy sector cybersecurity firm Dragos notes in their 2024 Critical Infrastructure Report that firmware manipulation accounts for 32% of successful OT attacks.

Attack Scenarios with Real-World Parallels

  • Grid Destabilization: Malicious actors could synchronize attacks across multiple chargers during peak demand, creating sudden load surges that trigger cascading grid failures. The 2023 attack on Swiss charging stations demonstrated this capability when 150 simultaneous high-power draws caused localized blackouts.
  • Ransomware Enclaves: Compromised stations could hold vehicles hostage by locking charging ports until cryptocurrency payments are made, mirroring the 2024 "ChargeLocker" incidents across Scandinavian highway networks.
  • Data Exfiltration: As noted in MITRE's ATT&CK for ICS framework, compromised chargers become surveillance nodes capturing vehicle IDs, user credentials, and mobility patterns—data goldmines for espionage or black markets.

Siemens' Response and Mitigation Gaps

Siemens' ProductCERT team has rolled out firmware version 4.2.1 with patches addressing both CVEs, emphasizing their hardware root of trust implementation that cryptographically verifies firmware integrity. The mitigation strategy includes:
- Digital signature enforcement for all configuration changes
- Modbus communication encryption via TLS 1.3
- Compiler-level stack protection enhancements

However, three critical gaps persist:
1. Patch Deployment Lag: OT environments require extensive downtime testing; Siemens admits 60% of chargers won't receive updates within the critical 90-day window due to certification requirements from utility partners.
2. Supply Chain Blind Spots: Security firm Finite State's teardown of VersiCharge controllers revealed third-party components with unpatched OpenSSL vulnerabilities (CVE-2024-0727) not addressed in Siemens' updates.
3. Legacy Protocol Dependence: Despite patches, the continued use of unauthenticated Modbus creates persistent risk. As noted by SANS Institute's ICS director: "Patching flawed protocols is like repairing a dam with cracks—the fundamental design remains fragile."

The Critical Infrastructure Conundrum

EV chargers occupy a dangerous intersection in critical infrastructure security:
- IT/OT Convergence Risks: Chargers bridge corporate networks (for payment processing) and operational networks (grid control), creating attack paths where a compromised station could pivot to energy management systems. The 2024 E-ISAC report documented 17 incidents where charging stations served as entry points for utility network breaches.
- Lifecycle Management Challenges: With chargers deployed for 10-15 years, maintaining security against evolving threats becomes problematic. VersiCharge's discontinued Gen2 units (still representing 30% of deployments) cannot receive the current firmware patches.
- Regulatory Fragmentation: While NERC CIP standards govern transmission systems, EV chargers fall under ambiguous jurisdiction. The FTC's evolving "Energy Star Cybersecurity Specifications" lack enforcement teeth, creating compliance gray zones.

Forward-Looking Mitigation Framework

Beyond immediate patching, comprehensive security requires architectural shifts:

  1. Zero-Trust Implementation
    - Microsegmentation isolating payment, control, and grid communication channels
    - Device identity certificates replacing password-based authentication
    - Continuous anomaly detection using power consumption baselines

  2. Protocol Modernization
    - Transition from Modbus to OCPP 2.0.1 (Open Charge Point Protocol) with mandatory TLS and ISO 15118 certificate-based authentication
    - DNP3 Secure Authentication for grid communications

  3. Supply Chain Hardening
    - Software Bill of Materials (SBOM) transparency for all components
    - Compiler-level hardening (Control-Flow Integrity, Position-Independent Executables)

  4. Operator Action Plan
    markdown

    Priority Action Item Timeline
    Critical Apply firmware 4.2.1 with verified hash 48 hours
    High Segment charger networks from SCADA 30 days
    Medium Implement encrypted Modbus (TLS 1.3) 90 days
    Long-term Develop hardware refresh roadmap 12 months

The Bigger Picture: Securing the Electrification Wave

These vulnerabilities underscore a harsh reality: as nations race toward EV adoption targets (30% of vehicles by 2030 per IEA), security often lags behind deployment speed. The VersiCharge flaws aren't isolated—they reflect systemic issues in OT security:

  • Resource Asymmetry: Municipalities installing chargers rarely have ICS cybersecurity expertise, creating vulnerable "set-and-forget" deployments.
  • Testing Limitations: Unlike IT systems, charging stations cannot undergo routine penetration testing without risking physical damage or service disruption.
  • Economic Disincentives: Manufacturers prioritize uptime over security; Siemens' own product literature highlights "99.99% availability" with no mention of intrusion resilience.

Energy security researchers warn that unaddressed, these vulnerabilities could enable "black start" attacks—coordinated exploits preventing grid recovery after outages. As transportation and energy infrastructures fuse into a single attack surface, the VersiCharge vulnerabilities serve as a critical wake-up call. The solution demands collaborative frameworks where manufacturers, utilities, and cybersecurity communities jointly redefine security paradigms for the electrified age. Until then, every charging session represents not just energy transfer, but a calculated risk in our interconnected critical infrastructure.