OTPulse

Terra AC wallbox Heap Memory Corruption Vulnerability

MonitorCVSS 6.89AKK108471A8948Oct 20, 2025
ABB
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

ABB Terra AC wallbox firmware contains a heap memory corruption vulnerability (CWE-122) that allows an authenticated attacker to corrupt heap memory via a network request. Successful exploitation could enable remote control of the device and modification of the firmware, altering charging behavior. The vulnerability affects multiple regional variants of the Terra AC wallbox across firmware versions up to 1.8.32 (UL40/80A, MID, Juno CE, PTB) and 1.8.2 (UL32A, JP). Patches are available for all affected models. ABB recommends using OCPP over HTTPS rather than HTTP for backend connections.

What this means
What could happen
An attacker could corrupt heap memory on the Terra AC wallbox, potentially gaining remote control and modifying the device's firmware to alter charging behavior or disable operations.
Who's at risk
This advisory affects electric vehicle charging infrastructure operators. Organizations deploying ABB Terra AC wallboxes for EV charging (including UL40/80A, UL32A, MID/CE, Juno CE, PTB, and JP regional variants) should prioritize patching. This is relevant to utilities with EV charging networks, municipal charging stations, fleet operators, and parking facilities with networked charging equipment.
How it could be exploited
An attacker with login credentials sends a malicious network request to the wallbox that triggers heap corruption, leading to memory pollution. This could allow arbitrary code execution, which the attacker could leverage to rewrite the device firmware and persist the compromise.
Prerequisites
  • Valid login credentials to the Terra AC wallbox
  • Network access to the wallbox management interface
  • Knowledge of or ability to craft a message that triggers the heap corruption condition
Remotely exploitableRequires valid credentialsNo authentication required for some operationsAffects charging infrastructure availabilityFirmware modification risk
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (6)
6 with fix
ProductAffected VersionsFix Status
Terra AC wallbox (UL40/80A) <=1.8.32≤ 1.8.321.8.33
Terra AC wallbox (UL32A) <=1.8.2≤ 1.8.21.8.34
Terra AC wallbox (MID/ CE) Terra AC MID <=1.8.32≤ 1.8.321.8.34
Terra AC wallbox (MID/ CE) Terra AC Juno CE <=1.8.32≤ 1.8.321.8.34
Terra AC wallbox (MID/ CE) Terra AC PTB <=1.8.21≤ 1.8.211.8.33
Terra AC wallbox (JP) <=1.8.2≤ 1.8.21.8.34
Remediation & Mitigation
0/8
Do now
0/2
WORKAROUNDRestrict management interface access to trusted networks using firewall rules; do not expose the wallbox directly to the internet
HARDENINGUse OCPP over HTTPS (secure connection) instead of HTTP when connecting the wallbox to your backend system
Schedule — requires maintenance window
0/6

Patching may require device reboot — plan for process interruption

Terra AC wallbox (UL40/80A) <=1.8.32
HOTFIXUpdate Terra AC wallbox (UL40/80A) to firmware version 1.8.33 or later
Terra AC wallbox (UL32A) <=1.8.2
HOTFIXUpdate Terra AC wallbox (UL32A) to firmware version 1.8.34 or later
All products
HOTFIXUpdate Terra AC MID to firmware version 1.8.34 or later
HOTFIXUpdate Terra AC Juno CE to firmware version 1.8.34 or later
HOTFIXUpdate Terra AC PTB to firmware version 1.8.33 or later
HOTFIXUpdate Terra AC wallbox (JP) to firmware version 1.8.34 or later
View full ABB PSIRT advisory
API: /api/v1/advisories/f6f718f8-0c2c-4795-a461-91420fbb0038

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Terra AC wallbox Heap Memory Corruption Vulnerability | CVSS 6.8 - OTPulse