The vulnerability arises when an attacker sends a large volume of ICMP packets to an EVCharger board. This flood overwhelms the board’s processing resources and causes the board to become unresponsive, resulting in a denial of service for the electronic vehicle charging operation. The weakness is a classic denial‑of‑service flaw (CWE‑400) that disrupts the availability of the charging service.

Vendors affected are EFACEC’s QC series EVCharger boards, specifically models QC 60, QC 90 and QC 120. These boards manage the interface controlling the electric vehicle charging process. The vulnerability is documented by Thales Group and can be found on the vendor’s site.

Based on the description, the likely attack vector is that an attacker sends ICMP traffic from a network that can reach the charging station. The attack requires no special privileges on the target device and can be launched remotely if ICMP traversal is allowed. The CVSS base score is 8.2, indicating a high‑severity impact. The EPSS score is under 1 %, meaning the probability of exploitation in the near term is low, and the vulnerability is not currently listed in CISA’s KEV.