The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical advisory warning about multiple vulnerabilities in Hardy Barth's Salia EV Charge Controller, revealing that electric vehicle charging infrastructure has become a significant industrial attack surface. These vulnerabilities affect versions of the Salia controller firmware, exposing charging stations to remote code execution and unauthorized file uploads that could disrupt operations or compromise entire networks.

Critical Vulnerabilities in EV Charging Infrastructure

According to the CISA advisory, the Hardy Barth Salia EV Charge Controller contains multiple security flaws that could allow attackers to take control of charging stations. The most severe vulnerability enables remote code execution, giving attackers the ability to run arbitrary commands on affected devices. A separate file upload vulnerability allows unauthorized users to upload malicious files to the controller's system, potentially leading to further compromise or system disruption.

These vulnerabilities exist in specific firmware versions of the Salia controller, though CISA has not disclosed the exact version numbers affected. The advisory indicates that successful exploitation could allow attackers to disrupt charging operations, manipulate billing data, or use compromised charging stations as entry points into larger industrial control systems.

The Expanding Attack Surface of EV Infrastructure

Electric vehicle charging stations represent a particularly vulnerable component of critical infrastructure because they sit at the intersection of energy grids, transportation networks, and payment systems. Unlike traditional industrial control systems that operate in isolated environments, EV chargers often connect to multiple networks simultaneously—including power management systems, payment processors, and maintenance networks.

Security researchers have been warning about EV charging vulnerabilities for years, but the CISA advisory represents one of the first official confirmations of specific, exploitable flaws in commercial charging equipment. The Hardy Barth Salia controller is used in various charging station deployments, making these vulnerabilities potentially widespread.

Technical Analysis of the Vulnerabilities

The remote code execution vulnerability appears to stem from improper input validation in the controller's web interface or API endpoints. Attackers could potentially send specially crafted requests that bypass security checks and execute commands on the underlying operating system. This type of vulnerability is particularly dangerous because it gives attackers complete control over affected devices.

The file upload vulnerability likely involves insufficient validation of file types, sizes, or permissions when users upload files to the controller. Attackers could exploit this flaw to upload malicious scripts, configuration files, or firmware updates that could compromise the device or spread to connected systems.

Both vulnerabilities require network access to exploit, but many EV charging stations are connected to public networks for remote monitoring and management. Some installations may have additional security measures in place, but the default configurations of many industrial devices leave them exposed to these types of attacks.

Impact on Critical Infrastructure Security

EV charging stations serve as critical infrastructure components that support transportation electrification goals while connecting to power grids that must maintain stability and reliability. A coordinated attack on multiple charging stations could potentially cause localized power disruptions or create broader grid instability if enough stations were compromised simultaneously.

Beyond immediate operational impacts, compromised charging stations could be used to:

  • Manipulate billing and payment systems
  • Steal user data and payment information
  • Launch attacks against connected power management systems
  • Serve as footholds for broader industrial network penetration
  • Disrupt transportation during peak charging periods

The interconnected nature of modern infrastructure means that vulnerabilities in one system can cascade through multiple sectors. EV chargers that connect to smart grid systems could potentially provide pathways into utility control networks, while those integrated with building management systems could expose commercial facilities to additional risks.

Mitigation Strategies and Best Practices

CISA recommends several mitigation strategies for organizations operating Hardy Barth Salia EV Charge Controllers:

  1. Immediate isolation: Disconnect affected devices from public networks and implement network segmentation to limit potential attack vectors

  2. Access control: Implement strict access controls and authentication mechanisms for all management interfaces

  3. Monitoring: Deploy network monitoring solutions to detect unusual activity or attempted exploitation

  4. Patch management: Apply security patches as soon as they become available from the manufacturer

  5. Defense in depth: Implement multiple layers of security controls rather than relying on single-point solutions

Organizations should also consider conducting security assessments of their EV charging infrastructure to identify other potential vulnerabilities. This includes reviewing network configurations, access controls, and software update processes for all connected devices.

The Manufacturer's Response and Industry Implications

Hardy Barth has been notified of the vulnerabilities and is presumably working on patches or firmware updates to address the security flaws. However, the timeline for these fixes remains unclear, and organizations operating affected devices must implement interim security measures.

This advisory highlights broader concerns about the security of industrial Internet of Things (IIoT) devices, particularly those deployed in critical infrastructure environments. Many IIoT devices, including EV chargers, were designed with functionality and connectivity as primary concerns rather than security. Manufacturers often prioritize ease of deployment and remote management over robust security controls, creating systemic vulnerabilities across industrial sectors.

The EV charging industry faces particular challenges because it combines elements of consumer technology, industrial control systems, and critical infrastructure. Charging stations must be user-friendly for consumers while maintaining enterprise-grade security for operators—a difficult balance that many manufacturers have struggled to achieve.

Regulatory and Standards Landscape

The CISA advisory comes as regulatory bodies worldwide are developing security standards for EV charging infrastructure. In the United States, the National Institute of Standards and Technology (NIST) has been working on cybersecurity guidelines for electric vehicle supply equipment, while international standards organizations are developing similar frameworks.

Current regulations often focus on electrical safety and interoperability rather than cybersecurity, creating gaps that vulnerabilities like those in the Hardy Barth Salia controller can exploit. The growing recognition of EV infrastructure as critical infrastructure may lead to more stringent security requirements in the future, but existing deployments will need to address current vulnerabilities with available tools and practices.

Practical Steps for Organizations

Organizations operating EV charging infrastructure should take immediate action to assess their exposure to these vulnerabilities:

  • Inventory and assessment: Identify all EV charging equipment in your environment, including make, model, and firmware versions
  • Network mapping: Document how charging stations connect to other systems and networks
  • Risk evaluation: Assess the potential impact of charging station compromise on your operations and connected systems
  • Compensating controls: Implement additional security measures while waiting for vendor patches
  • Incident response planning: Develop specific response procedures for EV charging infrastructure incidents

For organizations using Hardy Barth equipment specifically, contacting the manufacturer for guidance on affected versions and available updates should be a priority. Those using other brands should not assume immunity—similar vulnerabilities likely exist in other EV charging systems that haven't yet been discovered or disclosed.

The Future of EV Charging Security

The disclosure of these vulnerabilities represents a turning point for EV charging security. As adoption accelerates and charging networks expand, security will need to become a fundamental design consideration rather than an afterthought. Future charging systems will likely incorporate:

  • Hardware-based security modules for cryptographic operations
  • Secure boot processes to prevent unauthorized firmware modifications
  • Regular security updates delivered through authenticated channels
  • Enhanced logging and monitoring capabilities
  • Standardized security interfaces for integration with enterprise security systems

Manufacturers that prioritize security now will have a competitive advantage as regulations tighten and customers become more aware of infrastructure risks. The transition to electric transportation depends on reliable, secure charging infrastructure—vulnerabilities that undermine confidence in that infrastructure could slow adoption and investment.

Conclusion: A Wake-Up Call for Industrial IoT Security

The Hardy Barth Salia vulnerabilities serve as a stark reminder that all connected industrial devices represent potential attack vectors. As critical infrastructure becomes increasingly digitized and interconnected, security must keep pace with innovation. The EV charging sector, like other industrial sectors undergoing digital transformation, needs to adopt security-by-design principles and implement robust security management practices.

Organizations should treat this advisory as an opportunity to review not just their EV charging security, but their entire industrial IoT security posture. The same vulnerabilities that affect EV chargers likely exist in other connected industrial devices—addressing them requires a systematic approach to industrial cybersecurity that spans technology, processes, and people.

While patches and updates will address the immediate vulnerabilities in the Hardy Barth Salia controller, the broader challenge of securing critical infrastructure against evolving threats will require ongoing vigilance, investment, and collaboration across industry, government, and security communities.