CVE-2025-27769: Siemens Heliox DC Fast Charger Charging-Cable Access Control Bypass (pending)

CVE-2025-27769 is an improper access control flaw (CWE-923) in Siemens Heliox Flex 180 kW and Heliox Mobile DC 40 kW DC fast-charging stations: an attacker with physical access to the vehicle-side charging cable connector can reach internal services on the charger that should not be reachable from that connector, and Siemens ProductCERT's own analysis rates the flaw 2.6 (low) on CVSS v3.1; NVD has not yet published its own Primary CVSS score.

CVE-2025-27769 (CWE-923, Improper Restriction of Communication Channel to Intended Endpoints) affects two Siemens Heliox DC fast-charging product lines. NVD's description states: "A vulnerability has been identified in Heliox Flex 180 kW EV Charging Station (All versions < F4.11.1), Heliox Mobile DC 40 kW EV Charging Station (All versions < L4.10.1). Affected devices contain improper access control that could allow an attacker to reach unauthorized services via the charging cable" (NVD).

Siemens' own Security Advisory SSA-126399 confirms the same two affected products and version ranges, and recommends operators "contact customer support for patch information via OTA update" to obtain the fixed firmware — F4.11.1 for the Flex 180 kW and L4.10.1 for the Mobile DC 40 kW (Siemens Security Advisory SSA-126399).

CISA republished the Siemens bulletin as ICS advisory ICSA-26-071-05, "Siemens Heliox EV Chargers," on 2026-03-12, carrying forward the same CWE-923 classification and the same affected version ranges for both charger models (CISA ICS advisory ICSA-26-071-05).

NVD tracks CVE-2025-27769 with status "Awaiting Analysis": it records only Siemens ProductCERT's own Secondary scores — CVSS v3.1 2.6 (low), vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, and CVSS v4.0 2.4 (low) — not NVD's own Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD). The vector's AV:P (physical attack vector) component matches the plain-text description: exploitation requires an attacker to have physical access to the charging cable connector itself, not remote network access, which keeps the severity low despite the access-control failure.

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00164 (5.6th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, operators of public or fleet-charging sites using Heliox Flex 180 kW or Heliox Mobile DC 40 kW stations should contact Siemens customer support for the OTA firmware update, and should treat physical tampering with the charging cable and connector housing as a credible attack path worth monitoring at unattended charging locations.

• Heliox Flex 180 kW EV Charging Station (all versions < F4.11.1) and Heliox Mobile DC 40 kW EV Charging Station (all versions < L4.10.1) contain improper access control that could allow an attacker to reach unauthorized services via the charging cable. — NVD
• Siemens Security Advisory SSA-126399 confirms the affected products and version ranges, and directs customers to contact support for the OTA update to F4.11.1 / L4.10.1. — Siemens Security Advisory SSA-126399
• CISA republished the Siemens advisory as ICSA-26-071-05, 'Siemens Heliox EV Chargers,' on 2026-03-12, with the same CWE-923 classification and affected version ranges. — CISA ICS advisory ICSA-26-071-05
• NVD status 'Awaiting Analysis'; records only Siemens ProductCERT's Secondary scores: CVSS v3.1 2.6 (vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) and CVSS v4.0 2.4; no NVD-published Primary score as of this review. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00164 (5.6th percentile) as of 2026-11-08. — FIRST EPSS