SaiFlow's Blog

With over 1.1 billion smart meters deployed worldwide and more than 2 billion expected by 2030, these increasingly connected grid assets are becoming a growing cybersecurity concern, requiring energy-aware protection against emerging threats.

SaiFlow's research uncovered an undocumented firmware update mechanism in XCharge C6 chargers that relies solely on attacker-controlled MD5 validation and executes embedded scripts as root, effectively enabling remote code execution through malicious firmware delivered via compromised servers, man-in-the-middle attacks, or CSMS compromise.

The EV charging industry has well-established security standards. OCPP provides clear guidelines for securing the communication channel between EV Chargers and the Charging Station Management System. While the industry has focused on securing the backend communication, the attack surface exposed through the CCS2 charging plug remains largely untested.

A malicious EV connecting to the CCS2 charging plug exploits SLAC protocol to compromise XCharge C6 and manipulate its power and cooling system controls

Code execution as root via USB storage device in FIMER's VSN700 Data Logger, as well as discussing the general practice in the industry.

A message smuggling vulnerability found on the Modbus protocol open-source library - Libmodbus