EVSEFuzz auto-builds fuzzers for EV charging protocol implementations
Original title: EVSEFuzz : A Tool for Automated Testing of Protocol Implementations
Runs against open- and closed-source chargers found several flaws and led to two published CVEs.
Researchers present EVSEFuzz, which uses Python datatype validation to infer message structures and emit both compliant and non-compliant inputs. The target is electric-vehicle supply equipment that speaks protocols such as OCPP between operators and chargers. The authors say tests of several open- and closed-source implementations uncovered vulnerabilities that resulted in two CVEs.
Unconfirmed: The abstract does not name the two CVEs or the implementations tested.
- EVSEFuzz generates both compliant and non-compliant protocol messages.
- It uses Python datatype validation to model message structures.
- Authors report tests on open- and closed-source implementations.
- Findings led to two published CVEs, which are not named.
From the original article
1 min read at arxiv.orgThe rapid adoption and development of electric vehicle (EV) networks has required the expansive deployment of EV charging infrastructure (EVCI) which relies on communication protocols such as the open charge point protocol (OCPP) to coordinate data transfer between charging network operators and the EV supply equipment.
By Soham Gumaste · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.