CVE-2022-0878

Electric Vehicle (EV) commonly utilises the Combined Charging System (CCS) for DC rapid charging. To exchange important messages such as the State of Charge (SoC) with the Electric Vehicle Supply Equipment (EVSE) CCS uses a high-bandwidth IP link provided by the HomePlug Green PHY (HPGP) power-line communication (PLC) technology. The attack interrupts necessary control communication between the vehicle and charger, causing charging sessions to abort. The attack can be conducted wirelessly from a distance using electromagnetic interference, allowing individual vehicles or entire fleets to be disrupted simultaneously. In addition, the attack can be mounted with off-the-shelf radio hardware and minimal technical knowledge. With a power budget of 1 W, the attack is successful from around 47 m distance. The exploited behavior is a required part of the HomePlug Green PHY, DIN 70121 & ISO 15118 standards and all known implementations exhibit it. In addition to electric cars, Brokenwire affects electric ships, airplanes and heavy duty vehicles utilising these standards.

• CWE-306
• CWE-306

• https://www.brokenwire.fail/Exploit, Third Party Advisory
• https://www.brokenwire.fail/Exploit, Third Party Advisory

Published

Apr 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-0871Missing Authorization in GitHub repository gogs/gogs prior t…9.1
• CVE-2022-0873The Gmedia Photo Gallery WordPress plugin before 1.20.0 does…4.8
• CVE-2022-0874The WP Social Buttons WordPress plugin through 2.1 does not …4.8
• CVE-2022-0875The Google Authenticator WordPress plugin before 1.0.5 does …4.3
• CVE-2022-0876The Social comments by WpDevArt WordPress plugin before 2.5.…4.8
• CVE-2022-0877Cross-site Scripting (XSS) - Stored in GitHub repository boo…5.4
• CVE-2022-0879The Caldera Forms WordPress plugin before 1.9.7 does not val…6.1
• CVE-2022-0880Cross-site Scripting (XSS) - Stored in GitHub repository sta…5.4
• CVE-2022-0881Insecure Storage of Sensitive Information in GitHub reposito…6.5
• CVE-2022-0882A bug exists where an attacker can read the kernel log throu…5.5
• CVE-2022-0883SLM has an issue with Windows Unquoted/Trusted Service Paths…7.8
• CVE-2022-0884The Profile Builder WordPress plugin before 3.6.8 does not s…4.8