On the first day of Pwn2Own Automotive 2025, security researchers managed to exploit 16 zero-day vulnerabilities and collected $382,750 in prize money.
The hacking competition, which focuses on automotive technologies, takes place in Tokyo from January 22 to January 24.
Fuzzware.io hacked the Autel MaxiCharger and Phoenix Contact CHARX SEC-3150 electric vehicle chargers using a stack-based buffer overflow and a validation error bug. As a result, the team won $50,000 and 10 Master of Pwn points (the most points on the first day).
See also: WordPress: Critical vulnerabilities in RealHome theme & Easy Real Estate plugin
Next up is Sina Kheirkhah of Summoning Team who earned $91,750 and 9.25 Master of Pwn points for breaching Ubiquiti and Phoenix Contact CHARX SEC-3150 EV chargers . The researcher used a hard-coded cryptographic key bug and a combination of three zero-days.
Synacktiv Team is in third place on the Pwn2Own Automotive 2025 leaderboard. The team won $57,500 after successfully demonstrating a bug in the OCPP protocol that allowed the ChargePoint Home Flex (Model CPH50) to be compromised
PHP Hooligans researchers successfully hacked a fully updated Autel charger and earned $50,000.
Finally, the Viettel Cyber Security raised $20,000 after executing code on Kenwood In-Vehicle Infotainment (IVI) using a zero-day command injection.
See also: New botnet exploits vulnerabilities in cameras and routers
Companies whose products are compromised during Pwn2Own Automotive have 90 days to develop and issue security patches. After that, TrendMicro's Zero Day Initiative publicly discloses the vulnerabilities, which means that hackers can begin exploiting them immediately.
During the Pwn2Own Automotive 2025 competition, security researchers can target electric vehicle (EV) chargers, in-vehicle infotainment (IVI) systems, and automotive operating systems.
The reaction from the hacker community and the public is always enthusiastic about these competitions. Everyone recognizes the importance of the competition in promoting the security of products and systems.
See also: Oracle January Patch: Fixes 320 new vulnerabilities
At the same time, such competitions give hackers themselves the opportunity to learn and be inspired by the techniques and strategies used by their other colleagues.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The Pwn2Own Automotive 2025 event strengthens the community ethical hacking, offering a platform for dialogue, idea exchange and collaboration.
Source: www.bleepingcomputer.com
