Improper Access Control in Siemens Heliox EV Chargers Enables Unauthorized Service Access via Charging Cable
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Mar 12, 2026
Siemens Heliox EV chargers were disclosed to contain an improper access control weakness (CWE-923) that could allow an attacker with physical access to the charging interface to reach unauthorized services via the charging cable. CISA published an ICS advisory describing the issue and noting Siemens has released updated software versions; the advisory lists affected models including the Heliox Flex 180 kW EV Charging Station and Heliox Mobile DC 40 kW EV Charging Station, and scores the issue CVSS v3.1 2.6 (Low) with a vector indicating a physical attack requirement (e.g., AV:P). Siemens recommends updating to fixed versions and protecting device/network access per its industrial security operational guidelines.
Canada’s Centre for Cyber Security also highlighted Siemens’ March 2026 advisory set, including updates for Heliox Flex (prior to F4.11.1) and Heliox Mobile DC 40 (prior to L4.10.1), alongside unrelated Siemens product lines (e.g., Mendix, RUGGEDCOM, SIMATIC). A separate Canadian advisory covering Schneider Electric products (EcoStruxure and Modicon lines) is a different vendor’s disclosure and does not pertain to the Siemens Heliox EV charger vulnerability.
