PIBuster Attack Can Permanently Brick 6 in 10 Public EV Chargers
Oxford researchers downloaded the Parameter Information Block from 41 of 69 sampled California CCS connectors. In a lab testbed, every readable PIB accepted a remote overwrite that permanently disables the modem — prevention is a config change, recovery needs new hardware.
University of Oxford researchers found that 41 of 69 sampled public CCS connectors would hand over their Parameter Information Block, and showed in a lab testbed that any readable PIB also accepts a remote overwrite that permanently disables the modem. Prevention is a config change; recovery is not.
SEATTLE, WASHINGTON — At the 3rd USENIX Symposium on Vehicle Security and Privacy (VehicleSec '25) in August 2025, Marcell Szakály, Sebastian Köhler and Ivan Martinovic of the University of Oxford unveiled a physical attack targeting the backbone of municipal electric vehicle (EV) infrastructure. The attack, dubbed PIBuster, allows an adversary with physical access to a standard Combined Charging System (CCS) cable to permanently disable a charger’s power-line communication modem, with no software recovery path once it lands. A related talk by Jan Berens and Marcell Szakály, One Modem to Brick Them All, had run two days earlier at DEF CON 33.
The researchers sampled 69 public CCS connectors in California and were able to download the PIB from 41 of them, a 59% rate. For ethical reasons they never wrote to a public charger: the collected PIBs were replayed against a two-modem lab testbed, and every PIB that could be read also accepted a remote write. Unlike traditional network-based exploits, PIBuster inflicts damage that cannot be undone in software.
The Attack Vector: Physical-Layer Sabotage
The PIBuster exploit targets the Parameter Information Block (PIB) — a critical configuration segment within the charger’s Power Line Communication (PLC) module. By emulating a legitimate electric vehicle, the attacker joins the charger’s internal network and exploits an unsecured write function to overwrite the PIB. A single configuration byte at PIB offset 0x1F8C decides whether remote reads and writes are allowed at all.
The "Permanent Brick" Process
- Malicious Handshake: An attacker connects a custom device (emulating an EV) to the public charging cable.
- Network Entry: The device joins the PLC network using the ISO 15118 protocol.
- PIB Overwrite: The attacker sends a malicious configuration to the Parameter Information Block.
- Modem Lockout: The overwrite disables the modem’s SPI link to its host controller and sets a random 16-byte Network Membership Key, so the modem answers neither the charger’s own hardware nor the power-line network.
- Total Loss: A third change, at PIB offset 0x1F8C, denies any further remote writes. Nothing is corrupted and the charger’s firmware is untouched; the modem is simply unreachable from every interface a fix could arrive on.
Municipal Impact: Operational and Strategic Disruption
The paper stops at the connector; what follows separates its findings from CyberSignal’s own read.
- Repair Scope: The paper’s conclusion is that the fix for a bricked unit is replacing the PLC module, not the whole charger.
- Corridor Risk, Unmodeled: The paper does not model fleet-level impact. CyberSignal’s own read is that the attack’s properties invite the concern: an adversary who can disable units one at a time, permanently and without network access, is a different planning problem than one who can only take a charger offline until it reboots, and a coordinated drive-by pass along a corridor would leave every unit it touched waiting on a service visit.
- No Recovery Path: Once an attacker sets a random network key and denies remote writes, neither the host interface nor the power-line network can reach the modem. Nothing sent over the wire brings it back.
The CyberSignal Analysis: Strategic Signals
Signal 01 — The "Air-Gap" Fallacy
Many municipal critical infrastructure projects assume that because a device isn’t on the public internet, it is safe. PIBuster makes the case that the charging cable itself is a high-bandwidth entry point capable of taking a unit permanently out of service.
Signal 02 — The New Urban Attack Surface
As cities move toward total electrification, the "gas station" of the future is now a networked IoT device vulnerable to physical-layer attacks. This shifts the threat model from remote hackers to local saboteurs.
Signal 03 — Recovery Fragility
PIBuster is cheap to prevent and impossible to undo remotely. One configuration byte closes the door beforehand; afterward there is no equivalent switch, because a locked-out modem has to be reached in person. That asymmetry is the part operators should plan around: EV charging hardware assumes that whatever breaks remotely can be fixed remotely, and this attack is a case where that does not hold.
Qualcomm has acknowledged the issue and told the researchers that future firmware versions will default to the secure setting regardless of how the PIB is configured. Operators who cannot wait for that firmware can set PIB offset 0x1F8C to 1 across their fleet, which blocks remote PIB reads and writes; the EV charging protocol itself does not rely on that feature.
Corrected August 19, 2026: An earlier version of this article said a charger could be bricked in under 30 seconds, gave estimated remediation costs, and said the attack could strand a large number of vehicles; the research supports none of those figures, and all three claims have been withdrawn. Sources that were cited but not linked have been replaced with the primary USENIX VehicleSec '25 paper and the related DEF CON 33 talk. The body of the article was revised along with the summary and metadata, all of which had described a lab result as a field demonstration: the researchers read the PIB from public connectors but never wrote to one, and prevention through configuration is possible even though recovery is not.
