ISO 15118 security: Plug & Charge PKI, TLS, and the SLAC MITM gap

ISO 15118, "Road vehicles — Vehicle to grid communication interface," is the international standard (developed jointly by ISO and IEC starting in 2010, with the first parts published 2013-2014) that governs digital communication between an electric vehicle (EV) and the charging station it is plugged into — technically, between the Electric Vehicle Communication Controller (EVCC) in the car and the Supply Equipment Communication Controller (SECC) in the charger. It is distinct from OCPP (Open Charge Point Protocol), the separate backend protocol connecting the charging station itself to a network operator's management system; ISO 15118 covers only the vehicle-to-charger link. The standard defines the full session: low-level signaling per IEC 61851, powerline network pairing via the SLAC (Signal Level Attenuation Characterization) protocol, IPv6 addressing, the V2GTP transport protocol, and — where implemented — TLS encryption of the session plus the Plug & Charge (PnC) authentication flow that lets a vehicle authorize payment automatically via digital certificates instead of an RFID card or app. Security (TLS, certificate-based authentication) is present in the standard but, in the widely deployed ISO 15118-2 (2014) edition, it is optional rather than mandatory, which is the root of most of the documented exposure described below.

Plug & Charge is the ISO 15118 feature where a driver plugs in the cable and the vehicle and charging network authenticate and authorize payment automatically, with no card tap or app interaction, using a public-key-infrastructure (PKI) model: the EV holds a contract certificate (tied to a unique EMAID, the e-Mobility Account Identifier assigned by the driver's mobility service provider) that it presents to the charging station, which validates it against a V2G Root certificate chain. This is a materially different trust model from two older or simpler alternatives still in the field. External Identification Means (EIM) is the fallback non-PnC path — an RFID card, app, or QR code — where authorization happens outside the vehicle-to-charger link entirely. Autocharge, based on DIN SPEC 70121, is a lighter-weight, non-standardized predecessor that identifies the vehicle by its network MAC address with no certificate chain at all; because it has no cryptographic binding, some automakers (Volkswagen among them, per public reporting) now randomize vehicle MAC addresses for privacy, which breaks Autocharge compatibility as a side effect. Plug & Charge, by contrast, is the only one of the three built on signed, PKI-issued credentials rather than a static identifier or an out-of-band token.

CharIN (Charging Interface Initiative e.V.), the industry body that also stewards the Combined Charging System (CCS), operates a V2G Root Certificate Authority open to any participating OEM, charge point operator (CPO), or e-mobility service provider (eMSP) that accepts its governance terms, documented in separate Certificate Policies for a first-generation PKI (compliant with ISO 15118-2) and a second-generation PKI (compliant with ISO 15118-20). In the contract-certificate flow, a Certificate Provisioning Service (CPS) signs the contract data — including the vehicle's EMAID — with a certificate chain that traces back to the CharIN V2G Root, and the signed contract certificate is placed in a Contract Certificate Pool (CCP) for installation into the vehicle, either at point of sale or over the air. During a charging session, the vehicle presents this contract certificate, and the charging station (or its backend) validates the signature chain up to the V2G Root already trusted by the ecosystem, without needing to contact the vehicle's home mobility provider in real time. CharIN's PKI participation rules require all participants to publish certificate status via OCSP or CRL so a revoked contract certificate can actually be checked, and to support cross-root interoperability so a contract issued by one PKI participant's CPS is still honored by a charging station operated by a different one.

CVE-2025-12357, disclosed by Mark I. Johnson of Southwest Research Institute (SwRI) and published via a CISA advisory, is an "improper restriction of communication channel to intended endpoints" weakness (CVSS 3.1 base score 6.3, vector AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L — network-adjacent, low complexity, no privileges or user interaction required) in the SLAC (Signal Level Attenuation Characterization) pairing step that ISO 15118-2 uses to determine which physical charging station a given vehicle is actually plugged into over the shared powerline network. CISA's advisory states the flaw lets an attacker manipulate or spoof SLAC signal-attenuation measurements to insert a man-in-the-middle between the EV and the charger, and notes it may be "exploitable wirelessly, within close proximity, via electromagnetic induction" — meaning a direct physical splice into the charging cable is not strictly required. Because SLAC pairing is a required step defined by the ISO 15118-2 standard itself rather than a bug in one vendor's implementation, CISA's advisory states the issue affects any EVSE or vehicle implementing ISO 15118-2 SLAC pairing, independent of firmware version. CISA's and ISO's own stated mitigation is to move to ISO 15118-20 with TLS and certificate chaining enforced for all sessions, alongside conventional network isolation and VPN guidance for remote access to charging infrastructure.

Brokenwire (presented at NDSS 2023, "Brokenwire: Wireless Disruption of CCS Electric Vehicle Charging") is a denial-of-charging attack, not an eavesdropping or impersonation attack like the SLAC MITM flaw — it does not read or forge data, it simply stops a legitimate session from continuing. ISO 15118-3 mandates HomePlug Green PHY (HPGP) as the physical-layer powerline carrier for the ISO 15118/DIN 70121 control channel, and HPGP's OFDM-based, CSMA/CA (carrier-sense multiple-access with collision avoidance) design — built to tolerate noisy electrical environments — behaves enough like an over-the-air RF protocol that it can be coupled into wirelessly, not just via a direct wire tap. The researchers showed that exploiting the mandatory CSMA/CA collision-avoidance behavior lets an attacker disrupt the link with a radio signal of under 1 watt, over three orders of magnitude more power-efficient than plain broadband jamming, at ranges up to 47 meters (151 feet), using off-the-shelf radio hardware, and validated it against 8 vehicles and 20 commercial chargers in real deployments. Because the ISO 15118 standard specifies that a charging session aborts automatically once short control messages are lost, the attack's effect — an interrupted, non-resumable charging session — follows directly from the standard's own fault-handling behavior. The researchers state plainly that "the exploited behavior is a required part of the HomePlug Green PHY, DIN 70121 & ISO 15118 standards and all known implementations exhibit it," making this a standards-level gap rather than an implementation defect in any single charger or vehicle.

ISO 15118-2 (2014), the widely deployed first generation, made TLS 1.2 optional and, where used, one-directional: the charging station (SECC) authenticates itself to the vehicle, but the standard provides no equivalent cryptographic mechanism for the vehicle to prove its identity to the charger beyond a challenge-response exchange carried inside that one-way channel. ISO 15118-20 (2022), the second generation, makes TLS 1.3 the baseline and requires mutual authentication: both the EVCC and SECC must present and validate a certificate chain before energy transfer begins, which requires issuing a vehicle-side TLS certificate in addition to the existing contract certificate used for Plug & Charge authorization. ISO 15118-20 also incorporates ISO 15118-2 by reference for backward compatibility, and a session's actual protocol version is negotiated based on which TLS version both sides support — meaning a mixed fleet of 15118-2-only vehicles and 15118-20 chargers (or vice versa) will silently fall back to the weaker, optional, one-way TLS model. Multiple industry and research sources describe this fallback, plus the reality that TLS remains optional in practice on much of the installed 15118-2 base, as the reason mutual TLS is "not currently widely used" across real-world CCS deployments despite being specified since 2022; hardware is also a factor; several industry write-ups note that most ISO 15118-2 charger control boards cannot be firmware-upgraded to 15118-20's mandatory mutual TLS 1.3 and larger certificate payloads because the jump exceeds what their existing cryptographic hardware was built to handle.