Large volumes of ARP requests overwhelm the control board of the charger, causing a denial of service that prevents the charger from functioning and disables EV interface control. The flaw is a failure to limit flood traffic, classified as an input handling weakness. The resulting loss is a disruption of the charger's availability.

EFACEC QC60, QC90, and QC120 charger models are affected. No specific firmware or hardware revision details were provided, so all variants of these models and their associated chemistry boards may be impacted.

The CVSS score of 9.2 indicates a critical impact, but the EPSS score of less than 1% suggests an exceedingly low likelihood of exploitation in the wild. The vulnerability is not listed in the KEV catalog. The attack vector is inferred to be network-based, requiring an adversary to send large volumes of ARP traffic to the charger—likely from a position on the same local network or compromised device. Once an attacker can flood the board, the charger becomes inoperable, affecting availability for all connected vehicles.