CVE-2025-24956 is a medium severity buffer overflow (CVSS 6.2) in OpenV2G versions before 0.9.6, caused by a missing length check when parsing X509 serial numbers in EXI data. Siemens advises updating to V0.9.6 or later. Rebuild anything that bundles OpenV2G and check your charging software.
What's affected
The NVD record and Siemens advisory SSA-647005 name OpenV2G, all versions before V0.9.6. OpenV2G is open source software for the vehicle to grid communication used in electric vehicle charging. The EXI parsing feature is missing a length check when it reads X509 serial numbers, so an attacker could cause a buffer overflow that leads to memory corruption.
The vector shows a local attack vector, low complexity, no privileges and no interaction, with high impact on availability only. That reads as a crash more than takeover, though memory corruption is a class where outcomes can be worse, so patch rather than rely on the score.
The record is not on the CISA Known Exploited Vulnerabilities list. Siemens published the advisory on 2025-02-11.
The weakness is classed as CWE-120 (classic buffer overflow). The score is 6.2 (MEDIUM). The vector, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reads as a local attack, low attack complexity, no privileges required and no user interaction. Impact is no on confidentiality, no on integrity and high on availability. The record was published on 2025-02-11.
Siemens recommends updating to V0.9.6 or a later version of OpenV2G, available through the project's release page on SourceForge. The advisory lists no other workaround beyond its general security recommendations.
How to check if you're exposed
OpenV2G is a library, so it may sit inside charging station software or an EV related product you ship or buy. Look for it there.
- If you build charging software, search your repositories and build files for OpenV2G, and find the version you vendored in.
grep -rniE "openv2g" --include=*.txt --include=*.cmake --include=Makefile --include=*.md .
- Read the version from the release you copied, and compare it with V0.9.6.
- If you buy charging equipment, ask the supplier whether the product includes OpenV2G and which version.
- Check your software bill of materials for the component, if you keep one.
The free dependency scan in your browser can help when OpenV2G is declared in a manifest, but vendored C code often is not, so a text search is useful as well.
What to do now
- Find every place OpenV2G is used, including copies vendored into other projects.
- Update to V0.9.6 or later and rebuild the affected software.
- Ask suppliers of charging hardware whether their firmware bundles an affected version and when it will be updated.
- Test the EXI parsing path after the update, including handling of certificates with long serial numbers.
- Follow Siemens' general security recommendations for network protection of devices.
Why it matters
A classic buffer overflow, listed as CWE-120, happens when code copies data into a memory area without checking that it fits. Here the data is the serial number inside an X509 certificate, a field the sender chooses. A parser that trusts its length can write past the end of its buffer.
The score is only 6.2 because the vector is local and the stated impact is on availability. Even so, memory corruption bugs deserve attention in code that handles certificates and talks to vehicles. The fix is small: check the length before copying. The hard part is knowing where the library lives, which is why a component inventory pays off.
If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.
Quick check
Which OpenV2G version fixes CVE-2025-24956?
V0.9.6 or later, according to Siemens advisory SSA-647005.
Why is the score only 6.2?
The vector rates the attack as local, with impact on availability and none on confidentiality or integrity. It is still worth patching, because memory corruption can behave worse than a score implies.
Sources
- Safeguard Gold entry for CVE-2025-24956
- NVD record data for CVE-2025-24956 (published 2025-02-11)
- Siemens advisory SSA-647005
Last reviewed: 19 October 2026.
