July 20, 2026
EV Charger Hacks: What NJ Businesses Should Know
July 20, 2026
Most business owners think about cybersecurity in terms of laptops, email, and maybe their server room. Fair enough. But if your building has an EV charging station, or if you're thinking about adding one, that device is almost certainly connected to a network. And right now, that category of hardware is getting serious attention from security researchers for all the wrong reasons.
CISA recently published an advisory about vulnerabilities in EV charging backend software. The short version: some systems had no real authentication on a key network endpoint, no limit on login attempts, and sessions that didn't expire properly. A CVSS score of 9.8 out of 10. That's about as bad as it gets.
I'm not writing this to scare you about your specific charger brand. I'm writing it because this is a good example of a problem that shows up constantly with connected hardware, and most small businesses aren't set up to deal with it.
EV chargers, smart thermostats, IP cameras, badge readers, VoIP phones. All of these things connect to your network. Most of them run software that can have vulnerabilities. Almost none of them get patched regularly, because nobody's job description includes "check the firmware on the parking lot charger."
When I go into a new client site, I almost always find at least a few devices on the main network that have no business being there. A camera system from 2018 still running default credentials. A smart TV in the conference room sitting on the same VLAN as the file server. These aren't theoretical risks. They're open doors.
The EV charger situation is a concrete version of this. If the backend software has an unauthenticated websocket endpoint, an attacker on the same network segment could potentially escalate privileges. That means access they shouldn't have, to systems they shouldn't touch.
You don't need to panic, but you do need a process. Here's what I'd recommend.
First, get a list of every device on your network. Not just computers and phones. Everything. A proper network scan will surprise you. Tools like Auvik or even a basic Nmap sweep will show you what's actually connected.
Second, put IoT and specialty hardware on a separate VLAN. Your EV charger, your cameras, your building access system. None of these should be able to talk to your workstations or your Microsoft 365 tenant by default. Segmentation is one of the highest-value things you can do, and it doesn't require expensive hardware if you're already running a managed switch.
Third, figure out who's responsible for firmware updates on each device. For your computers, that's probably handled through Intune or Windows Update for Business if you're working with an MSP. But the charger? The camera system? Someone needs to own that. Write it down. Put it on a calendar.
Fourth, if you're buying new hardware for your office, ask the vendor about their patch and update process before you sign anything. A device that never gets security updates is a liability, not an asset.
The honest answer is that manufacturers of physical hardware have historically been bad at security. Software companies got beaten up by the market and by regulators for shipping insecure products, so most of them improved. Hardware manufacturers are still catching up. That's slowly changing, but it means the devices already deployed at thousands of businesses are running software that was written without much security discipline.
For a business in NJ or NYC, the exposure is real. Dense commercial areas, shared building infrastructure, lots of people with network access. The attack surface is bigger than it looks.
Do a device audit. Segment your network. Assign ownership for firmware updates on every connected device. If you have EV chargers or any managed charging infrastructure, contact the vendor and ask directly whether their backend software has been patched recently and what their disclosure process looks like.
If you're not sure where to start with any of this, Exine works with small and mid-size businesses across NJ and NYC to get this kind of thing sorted out properly.
