EVSEFuzz finds multiple vulnerabilities in OCPP charging protocol implementations
The claim
EVSEFuzz can automatically generate fuzzers that discover security flaws in EV charging protocol software
Published as: “EVSEFuzz : A Tool for Automated Testing of Protocol Implementations”
So what
The denial-of-service bugs could be exploited to disrupt EV charging services and compromise operator infrastructure.
The five-minute version
EVSEFuzz discovered multiple zero-day vulnerabilities in open-source OCPP implementations, including two CVEs (CVE-2025-59399 and CVE-2025-59398) caused by out-of-bounds string handling that can lead to denial-of-service attacks. The tool automatically builds fuzzers from JSON or XML schemas using Pydantic to generate both compliant and malformed messages, and it was evaluated on three real-world implementations, sending 10,000 random messages per run. Evidence is based on concrete CVE disclosures and logged crashes, but the evaluation lacks a comparative baseline and requires manual analysis of responses, limiting the strength of the claim.
What they found 4
- Out-of-bounds string handling in libocpp caused a crash in EVerest leading to a denial-of-service vulnerability (CVE-2025-59399).
“CVE-2025-59399 [5] field causes a crash in EVerest leading to potential denial of service attack.”
- Out-of-bounds access in the everest-framework caused a crash (CVE-2025-59398).
“CVE-2025-59398 [6] everest-framework. [7] EVerest to crash, leading to potential denial of service attack.”
- Presence of NaN in integer fields caused the system to accept invalid messages as valid.
“the presence of the value NaN in fields that expected an integer consistently caused the system to falsely accept invalid messages as valid.”
- Omitting required fields with the schema fuzzer caused the server to crash and sever the connection.
“the schema fuzzer would omit one or more required fields for a message, causing the server to not reject the message, but crash and subsequently sever the fuzzer’s connnection to it.”
What undercuts it the paper’s own results
- At the moment, checking the validity of system responses to fuzzer messages requires manual analysis, but can be done quickly due to the validity of the sent message being denoted before its matching response.
- It should be noted that this does not mean that the message was responsible for this interruption.
Stated limits 3
- One of the major drawbacks of using an arbitrary fuzzing strategy is that coverage of the protocol implementations may be limited.
- At the moment, checking the validity of system responses to fuzzer messages requires manual analysis.
- While we cannot comment on the results found in our partner EV charging company, we found several vulnerabilities in EVerest, as shown in Table 1.
What’s new here 4
- Automatic generation of both compliant and non-compliant protocol messages from JSON/XML schemas using runtime data-validation (Pydantic).
- Black-box fuzzing that does not require source code access, suitable for proprietary EV charging software.
- Inclusion of state-specification files to reach deeper protocol states and inject malicious payloads (e.g., SQL injection, XSS).
- Support for multiple EV charging protocols (OCPP, OCPI, OpenADR) with a single tool.
Artifacts & methods 5
- EVSEFuzzsystem
- Pydantic data-validation libraryprimitive
- JSON/XML schema specificationsdataset
- State specification filesdataset
- Datatype, Schema, and Sequence fuzzerssystem