Search
Find a vulnerability
Search criteria
40 vulnerabilities by autel
VAR-202506-0580
Vulnerability from variot - Updated: 2025-09-15 23:34Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability.
The specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains an incorrect authentication vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202506-0580",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac pro",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact mobile",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact pedestal",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc fast",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac elite business c50",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac ultra",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc hipower",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dh480",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial",
"scope": null,
"trust": 0.7,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.39.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.56.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-340"
},
{
"db": "CNVD",
"id": "CNVD-2025-14950"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013733"
},
{
"db": "NVD",
"id": "CVE-2025-5822"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)",
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-340"
}
],
"trust": 0.7
},
"cve": "CVE-2025-5822",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CNVD-2025-14950",
"impactScore": 7.8,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2025-5822",
"impactScore": 4.2,
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2025-5822",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2025-5822",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "ZDI",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2025-5822",
"impactScore": 4.2,
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2025-5822",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2025-5822",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2025-5822",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2025-5822",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2025-14950",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-340"
},
{
"db": "CNVD",
"id": "CNVD-2025-14950"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013733"
},
{
"db": "NVD",
"id": "CVE-2025-5822"
},
{
"db": "NVD",
"id": "CVE-2025-5822"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability. \n\nThe specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains an incorrect authentication vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company",
"sources": [
{
"db": "NVD",
"id": "CVE-2025-5822"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013733"
},
{
"db": "ZDI",
"id": "ZDI-25-340"
},
{
"db": "CNVD",
"id": "CNVD-2025-14950"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2025-5822",
"trust": 3.9
},
{
"db": "ZDI",
"id": "ZDI-25-340",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013733",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-26325",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-14950",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-340"
},
{
"db": "CNVD",
"id": "CNVD-2025-14950"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013733"
},
{
"db": "NVD",
"id": "CVE-2025-5822"
}
]
},
"id": "VAR-202506-0580",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14950"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14950"
}
]
},
"last_update_date": "2025-09-15T23:34:42.424000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for Autel MaxiCharger AC Wallbox Commercial Privilege Escalation Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/704546"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14950"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-863",
"trust": 1.0
},
{
"problemtype": "Illegal authentication (CWE-863) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013733"
},
{
"db": "NVD",
"id": "CVE-2025-5822"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-25-340/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2025-5822"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14950"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013733"
},
{
"db": "NVD",
"id": "CVE-2025-5822"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-25-340"
},
{
"db": "CNVD",
"id": "CNVD-2025-14950"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013733"
},
{
"db": "NVD",
"id": "CVE-2025-5822"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-340"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14950"
},
{
"date": "2025-09-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2025-013733"
},
{
"date": "2025-06-25T18:15:22.900000",
"db": "NVD",
"id": "CVE-2025-5822"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-340"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14950"
},
{
"date": "2025-09-11T23:17:00",
"db": "JVNDB",
"id": "JVNDB-2025-013733"
},
{
"date": "2025-09-10T14:46:51.023000",
"db": "NVD",
"id": "CVE-2025-5822"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0autel\u00a0 Fraudulent Authentication Vulnerability in Products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013733"
}
],
"trust": 0.8
}
}
VAR-202506-0589
Vulnerability from variot - Updated: 2025-09-14 23:46Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the ble_process_esp32_msg function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26369. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a stack-based buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company. The vulnerability is caused by the ble_process_esp32_msg function failing to properly verify the length of the input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202506-0589",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac pro",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact mobile",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact pedestal",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc fast",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac elite business c50",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac ultra",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc hipower",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dh480",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial",
"scope": null,
"trust": 0.7,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.39.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.56.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-346"
},
{
"db": "CNVD",
"id": "CNVD-2025-14945"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013702"
},
{
"db": "NVD",
"id": "CVE-2025-5827"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Quarkslab",
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-346"
}
],
"trust": 0.7
},
"cve": "CVE-2025-5827",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CNVD-2025-14945",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2025-5827",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "OTHER",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2025-013702",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2025-5827",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2025-5827",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "OTHER",
"id": "JVNDB-2025-013702",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2025-5827",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2025-14945",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-346"
},
{
"db": "CNVD",
"id": "CNVD-2025-14945"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013702"
},
{
"db": "NVD",
"id": "CVE-2025-5827"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability. \n\nThe specific flaw exists within the ble_process_esp32_msg function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26369. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a stack-based buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company. The vulnerability is caused by the ble_process_esp32_msg function failing to properly verify the length of the input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2025-5827"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013702"
},
{
"db": "ZDI",
"id": "ZDI-25-346"
},
{
"db": "CNVD",
"id": "CNVD-2025-14945"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2025-5827",
"trust": 3.9
},
{
"db": "ZDI",
"id": "ZDI-25-346",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013702",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-26369",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-14945",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-346"
},
{
"db": "CNVD",
"id": "CNVD-2025-14945"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013702"
},
{
"db": "NVD",
"id": "CVE-2025-5827"
}
]
},
"id": "VAR-202506-0589",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14945"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14945"
}
]
},
"last_update_date": "2025-09-14T23:46:46.046000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for Autel MaxiCharger AC Wallbox Commercial Buffer Overflow Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/704521"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14945"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-121",
"trust": 1.0
},
{
"problemtype": "Stack-based buffer overflow (CWE-121) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013702"
},
{
"db": "NVD",
"id": "CVE-2025-5827"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-25-346/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2025-5827"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14945"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013702"
},
{
"db": "NVD",
"id": "CVE-2025-5827"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-25-346"
},
{
"db": "CNVD",
"id": "CNVD-2025-14945"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013702"
},
{
"db": "NVD",
"id": "CVE-2025-5827"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-346"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14945"
},
{
"date": "2025-09-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2025-013702"
},
{
"date": "2025-06-25T18:15:23.563000",
"db": "NVD",
"id": "CVE-2025-5827"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-346"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14945"
},
{
"date": "2025-09-11T08:20:00",
"db": "JVNDB",
"id": "JVNDB-2025-013702"
},
{
"date": "2025-09-10T14:46:42.947000",
"db": "NVD",
"id": "CVE-2025-5827"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0autel\u00a0 Stack-based buffer overflow vulnerability in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013702"
}
],
"trust": 0.8
}
}
VAR-202506-0627
Vulnerability from variot - Updated: 2025-09-14 23:46Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.
The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a firmware image before using it to perform an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-26354. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a vulnerability that allows the security version number to be changed to an older version.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202506-0627",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac pro",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact mobile",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact pedestal",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc fast",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac elite business c50",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac ultra",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc hipower",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dh480",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial",
"scope": null,
"trust": 0.7,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.39.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.56.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-344"
},
{
"db": "CNVD",
"id": "CNVD-2025-14949"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013701"
},
{
"db": "NVD",
"id": "CVE-2025-5825"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)",
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-344"
}
],
"trust": 0.7
},
"cve": "CVE-2025-5825",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.2,
"id": "CNVD-2025-14949",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "ADJACENT",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.6,
"id": "CVE-2025-5825",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "High",
"attackVector": "Adjacent Network",
"author": "OTHER",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2025-013701",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "HIGH",
"attackVector": "ADJACENT",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.6,
"id": "CVE-2025-5825",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2025-5825",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "OTHER",
"id": "JVNDB-2025-013701",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2025-5825",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2025-14949",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-344"
},
{
"db": "CNVD",
"id": "CNVD-2025-14949"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013701"
},
{
"db": "NVD",
"id": "CVE-2025-5825"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. \n\nThe specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a firmware image before using it to perform an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-26354. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a vulnerability that allows the security version number to be changed to an older version.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company",
"sources": [
{
"db": "NVD",
"id": "CVE-2025-5825"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013701"
},
{
"db": "ZDI",
"id": "ZDI-25-344"
},
{
"db": "CNVD",
"id": "CNVD-2025-14949"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2025-5825",
"trust": 3.9
},
{
"db": "ZDI",
"id": "ZDI-25-344",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013701",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-26354",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-14949",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-344"
},
{
"db": "CNVD",
"id": "CNVD-2025-14949"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013701"
},
{
"db": "NVD",
"id": "CVE-2025-5825"
}
]
},
"id": "VAR-202506-0627",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14949"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14949"
}
]
},
"last_update_date": "2025-09-14T23:46:00.438000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for Autel MaxiCharger AC Wallbox Commercial Code Execution Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/704541"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14949"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-1328",
"trust": 1.0
},
{
"problemtype": "Security version number can be changed to an older version (CWE-1328) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013701"
},
{
"db": "NVD",
"id": "CVE-2025-5825"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-25-344/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2025-5825"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14949"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013701"
},
{
"db": "NVD",
"id": "CVE-2025-5825"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-25-344"
},
{
"db": "CNVD",
"id": "CNVD-2025-14949"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013701"
},
{
"db": "NVD",
"id": "CVE-2025-5825"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-344"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14949"
},
{
"date": "2025-09-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2025-013701"
},
{
"date": "2025-06-25T18:15:23.303000",
"db": "NVD",
"id": "CVE-2025-5825"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-344"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14949"
},
{
"date": "2025-09-11T08:20:00",
"db": "JVNDB",
"id": "JVNDB-2025-013701"
},
{
"date": "2025-09-10T14:46:49.130000",
"db": "NVD",
"id": "CVE-2025-5825"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0autel\u00a0 Vulnerability that allows security version numbers in products to be changed to older versions",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013701"
}
],
"trust": 0.8
}
}
VAR-202506-0599
Vulnerability from variot - Updated: 2025-09-14 23:44Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of DLB_SlaveRegister messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26327. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a heap-based buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, USA. The vulnerability is caused by the DLB_SlaveRegister message failing to properly verify the length of the input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202506-0599",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac pro",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact mobile",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact pedestal",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc fast",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac elite business c50",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac ultra",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc hipower",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dh480",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial",
"scope": null,
"trust": 0.7,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.39.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.56.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-349"
},
{
"db": "CNVD",
"id": "CNVD-2025-14946"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013703"
},
{
"db": "NVD",
"id": "CVE-2025-5830"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "PHP Hooligans",
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-349"
}
],
"trust": 0.7
},
"cve": "CVE-2025-5830",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CNVD-2025-14946",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2025-5830",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "OTHER",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2025-013703",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2025-5830",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2025-5830",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "OTHER",
"id": "JVNDB-2025-013703",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2025-5830",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2025-14946",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-349"
},
{
"db": "CNVD",
"id": "CNVD-2025-14946"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013703"
},
{
"db": "NVD",
"id": "CVE-2025-5830"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability. \n\nThe specific flaw exists within the handling of DLB_SlaveRegister messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26327. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a heap-based buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, USA. The vulnerability is caused by the DLB_SlaveRegister message failing to properly verify the length of the input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2025-5830"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013703"
},
{
"db": "ZDI",
"id": "ZDI-25-349"
},
{
"db": "CNVD",
"id": "CNVD-2025-14946"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2025-5830",
"trust": 3.9
},
{
"db": "ZDI",
"id": "ZDI-25-349",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013703",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-26327",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-14946",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-349"
},
{
"db": "CNVD",
"id": "CNVD-2025-14946"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013703"
},
{
"db": "NVD",
"id": "CVE-2025-5830"
}
]
},
"id": "VAR-202506-0599",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14946"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14946"
}
]
},
"last_update_date": "2025-09-14T23:44:46.248000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for Autel MaxiCharger AC Wallbox Commercial Buffer Overflow Vulnerability (CNVD-2025-14946)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/704526"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14946"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-122",
"trust": 1.0
},
{
"problemtype": "Heap-based buffer overflow (CWE-122) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013703"
},
{
"db": "NVD",
"id": "CVE-2025-5830"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-25-349/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2025-5830"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14946"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013703"
},
{
"db": "NVD",
"id": "CVE-2025-5830"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-25-349"
},
{
"db": "CNVD",
"id": "CNVD-2025-14946"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013703"
},
{
"db": "NVD",
"id": "CVE-2025-5830"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-349"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14946"
},
{
"date": "2025-09-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2025-013703"
},
{
"date": "2025-06-25T18:15:23.950000",
"db": "NVD",
"id": "CVE-2025-5830"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-349"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14946"
},
{
"date": "2025-09-11T08:21:00",
"db": "JVNDB",
"id": "JVNDB-2025-013703"
},
{
"date": "2025-09-10T14:46:36.760000",
"db": "NVD",
"id": "CVE-2025-5830"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0autel\u00a0 Heap-based buffer overflow vulnerabilities in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013703"
}
],
"trust": 0.8
}
}
VAR-202506-0617
Vulnerability from variot - Updated: 2025-09-14 23:40Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of USB frame packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26328. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company. The vulnerability is caused by the USB frame packet failing to correctly verify the length of the input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202506-0617",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac pro",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact mobile",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact pedestal",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc fast",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac elite business c50",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac ultra",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc hipower",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dh480",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial",
"scope": null,
"trust": 0.7,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.39.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.56.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-347"
},
{
"db": "CNVD",
"id": "CNVD-2025-14948"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013732"
},
{
"db": "NVD",
"id": "CVE-2025-5828"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Synacktiv",
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-347"
}
],
"trust": 0.7
},
"cve": "CVE-2025-5828",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2025-14948",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 0.9,
"id": "CVE-2025-5828",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Physical",
"author": "OTHER",
"availabilityImpact": "High",
"baseScore": 6.8,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2025-013732",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 0.9,
"id": "CVE-2025-5828",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2025-5828",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "OTHER",
"id": "JVNDB-2025-013732",
"trust": 0.8,
"value": "Medium"
},
{
"author": "ZDI",
"id": "CVE-2025-5828",
"trust": 0.7,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2025-14948",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-347"
},
{
"db": "CNVD",
"id": "CNVD-2025-14948"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013732"
},
{
"db": "NVD",
"id": "CVE-2025-5828"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability. \n\nThe specific flaw exists within the handling of USB frame packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26328. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company. The vulnerability is caused by the USB frame packet failing to correctly verify the length of the input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2025-5828"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013732"
},
{
"db": "ZDI",
"id": "ZDI-25-347"
},
{
"db": "CNVD",
"id": "CNVD-2025-14948"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2025-5828",
"trust": 3.9
},
{
"db": "ZDI",
"id": "ZDI-25-347",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013732",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-26328",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-14948",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-347"
},
{
"db": "CNVD",
"id": "CNVD-2025-14948"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013732"
},
{
"db": "NVD",
"id": "CVE-2025-5828"
}
]
},
"id": "VAR-202506-0617",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14948"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14948"
}
]
},
"last_update_date": "2025-09-14T23:40:14.436000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for Autel MaxiCharger AC Wallbox Commercial Buffer Overflow Vulnerability (CNVD-2025-14948)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/704536"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14948"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-120",
"trust": 1.0
},
{
"problemtype": "Classic buffer overflow (CWE-120) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013732"
},
{
"db": "NVD",
"id": "CVE-2025-5828"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-25-347/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2025-5828"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14948"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013732"
},
{
"db": "NVD",
"id": "CVE-2025-5828"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-25-347"
},
{
"db": "CNVD",
"id": "CNVD-2025-14948"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013732"
},
{
"db": "NVD",
"id": "CVE-2025-5828"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-347"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14948"
},
{
"date": "2025-09-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2025-013732"
},
{
"date": "2025-06-25T18:15:23.683000",
"db": "NVD",
"id": "CVE-2025-5828"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-347"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14948"
},
{
"date": "2025-09-11T23:17:00",
"db": "JVNDB",
"id": "JVNDB-2025-013732"
},
{
"date": "2025-09-10T14:46:41.230000",
"db": "NVD",
"id": "CVE-2025-5828"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0autel\u00a0 Classic buffer overflow vulnerability in the product",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013732"
}
],
"trust": 0.8
}
}
VAR-202506-0616
Vulnerability from variot - Updated: 2025-09-14 23:37Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of JSON messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26330. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a stack-based buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company. The vulnerability is caused by the JSON message failing to properly validate the length of the input data
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202506-0616",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac pro",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact mobile",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact pedestal",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc fast",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac elite business c50",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac ultra",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc hipower",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dh480",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial",
"scope": null,
"trust": 0.7,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.39.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.56.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-348"
},
{
"db": "CNVD",
"id": "CNVD-2025-14947"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013687"
},
{
"db": "NVD",
"id": "CVE-2025-5829"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Tobias Scharnowski, Felix Buchmann, and Kristian Covic of fuzzware.io",
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-348"
}
],
"trust": 0.7
},
"cve": "CVE-2025-5829",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CNVD-2025-14947",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 0.9,
"id": "CVE-2025-5829",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Physical",
"author": "OTHER",
"availabilityImpact": "High",
"baseScore": 6.8,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2025-013687",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 0.9,
"id": "CVE-2025-5829",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2025-5829",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "OTHER",
"id": "JVNDB-2025-013687",
"trust": 0.8,
"value": "Medium"
},
{
"author": "ZDI",
"id": "CVE-2025-5829",
"trust": 0.7,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2025-14947",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-348"
},
{
"db": "CNVD",
"id": "CNVD-2025-14947"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013687"
},
{
"db": "NVD",
"id": "CVE-2025-5829"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability. \n\nThe specific flaw exists within the handling of JSON messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26330. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a stack-based buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company. The vulnerability is caused by the JSON message failing to properly validate the length of the input data",
"sources": [
{
"db": "NVD",
"id": "CVE-2025-5829"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013687"
},
{
"db": "ZDI",
"id": "ZDI-25-348"
},
{
"db": "CNVD",
"id": "CNVD-2025-14947"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2025-5829",
"trust": 3.9
},
{
"db": "ZDI",
"id": "ZDI-25-348",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013687",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-26330",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-14947",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-348"
},
{
"db": "CNVD",
"id": "CNVD-2025-14947"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013687"
},
{
"db": "NVD",
"id": "CVE-2025-5829"
}
]
},
"id": "VAR-202506-0616",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14947"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14947"
}
]
},
"last_update_date": "2025-09-14T23:37:51.731000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for Autel MaxiCharger AC Wallbox Commercial Buffer Overflow Vulnerability (CNVD-2025-14947)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/704531"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14947"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-121",
"trust": 1.0
},
{
"problemtype": "Stack-based buffer overflow (CWE-121) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013687"
},
{
"db": "NVD",
"id": "CVE-2025-5829"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-25-348/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2025-5829"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14947"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013687"
},
{
"db": "NVD",
"id": "CVE-2025-5829"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-25-348"
},
{
"db": "CNVD",
"id": "CNVD-2025-14947"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013687"
},
{
"db": "NVD",
"id": "CVE-2025-5829"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-348"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14947"
},
{
"date": "2025-09-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2025-013687"
},
{
"date": "2025-06-25T18:15:23.817000",
"db": "NVD",
"id": "CVE-2025-5829"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-348"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14947"
},
{
"date": "2025-09-11T07:59:00",
"db": "JVNDB",
"id": "JVNDB-2025-013687"
},
{
"date": "2025-09-10T14:46:38.487000",
"db": "NVD",
"id": "CVE-2025-5829"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0autel\u00a0 Stack-based buffer overflow vulnerability in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013687"
}
],
"trust": 0.8
}
}
VAR-202506-0623
Vulnerability from variot - Updated: 2025-09-14 23:26Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.
The specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a vulnerability related to exposing dangerous methods or functions.Information may be obtained. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202506-0623",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac pro",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact mobile",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact pedestal",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc fast",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac elite business c50",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac ultra",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc hipower",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dh480",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial",
"scope": null,
"trust": 0.7,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.39.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.56.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-341"
},
{
"db": "CNVD",
"id": "CNVD-2025-14952"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013688"
},
{
"db": "NVD",
"id": "CVE-2025-5823"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)",
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-341"
}
],
"trust": 0.7
},
"cve": "CVE-2025-5823",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CNVD-2025-14952",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.2,
"id": "CVE-2025-5823",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2025-5823",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 6.5,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2025-5823",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "ZDI",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.2,
"id": "CVE-2025-5823",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2025-5823",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2025-5823",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2025-5823",
"trust": 0.8,
"value": "Medium"
},
{
"author": "ZDI",
"id": "CVE-2025-5823",
"trust": 0.7,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2025-14952",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-341"
},
{
"db": "CNVD",
"id": "CNVD-2025-14952"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013688"
},
{
"db": "NVD",
"id": "CVE-2025-5823"
},
{
"db": "NVD",
"id": "CVE-2025-5823"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability. \n\nThe specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a vulnerability related to exposing dangerous methods or functions.Information may be obtained. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company",
"sources": [
{
"db": "NVD",
"id": "CVE-2025-5823"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013688"
},
{
"db": "ZDI",
"id": "ZDI-25-341"
},
{
"db": "CNVD",
"id": "CNVD-2025-14952"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2025-5823",
"trust": 3.9
},
{
"db": "ZDI",
"id": "ZDI-25-341",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013688",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-26351",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-14952",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-341"
},
{
"db": "CNVD",
"id": "CNVD-2025-14952"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013688"
},
{
"db": "NVD",
"id": "CVE-2025-5823"
}
]
},
"id": "VAR-202506-0623",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14952"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14952"
}
]
},
"last_update_date": "2025-09-14T23:26:39.480000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for Autel MaxiCharger AC Wallbox Commercial Information Disclosure Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/704556"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14952"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-749",
"trust": 1.0
},
{
"problemtype": "Exposing dangerous methods or functions (CWE-749) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013688"
},
{
"db": "NVD",
"id": "CVE-2025-5823"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-25-341/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2025-5823"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14952"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013688"
},
{
"db": "NVD",
"id": "CVE-2025-5823"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-25-341"
},
{
"db": "CNVD",
"id": "CNVD-2025-14952"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013688"
},
{
"db": "NVD",
"id": "CVE-2025-5823"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-341"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14952"
},
{
"date": "2025-09-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2025-013688"
},
{
"date": "2025-06-25T18:15:23.043000",
"db": "NVD",
"id": "CVE-2025-5823"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-341"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14952"
},
{
"date": "2025-09-11T08:00:00",
"db": "JVNDB",
"id": "JVNDB-2025-013688"
},
{
"date": "2025-09-10T14:46:52.680000",
"db": "NVD",
"id": "CVE-2025-5823"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0autel\u00a0 Vulnerabilities in products exposing dangerous methods or functions",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013688"
}
],
"trust": 0.8
}
}
VAR-202506-0609
Vulnerability from variot - Updated: 2025-09-12 23:41Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a vulnerability related to misinterpretation of input.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, an American company
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202506-0609",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc hipower",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac pro",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dh480",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger single charger",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact mobile",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac ultra",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac elite business c50",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc fast",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact pedestal",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial",
"scope": null,
"trust": 0.7,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.39.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.56.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-345"
},
{
"db": "CNVD",
"id": "CNVD-2025-14954"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013672"
},
{
"db": "NVD",
"id": "CVE-2025-5826"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Quarkslab",
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-345"
}
],
"trust": 0.7
},
"cve": "CVE-2025-5826",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "CNVD-2025-14954",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2025-5826",
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "OTHER",
"availabilityImpact": "Low",
"baseScore": 6.3,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "JVNDB-2025-013672",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "ZDI",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2025-5826",
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2025-5826",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "OTHER",
"id": "JVNDB-2025-013672",
"trust": 0.8,
"value": "Medium"
},
{
"author": "ZDI",
"id": "CVE-2025-5826",
"trust": 0.7,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2025-14954",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-345"
},
{
"db": "CNVD",
"id": "CNVD-2025-14954"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013672"
},
{
"db": "NVD",
"id": "CVE-2025-5826"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability. \n\nThe specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a vulnerability related to misinterpretation of input.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, an American company",
"sources": [
{
"db": "NVD",
"id": "CVE-2025-5826"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013672"
},
{
"db": "ZDI",
"id": "ZDI-25-345"
},
{
"db": "CNVD",
"id": "CNVD-2025-14954"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2025-5826",
"trust": 3.9
},
{
"db": "ZDI",
"id": "ZDI-25-345",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013672",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-26368",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-14954",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-345"
},
{
"db": "CNVD",
"id": "CNVD-2025-14954"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013672"
},
{
"db": "NVD",
"id": "CVE-2025-5826"
}
]
},
"id": "VAR-202506-0609",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14954"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14954"
}
]
},
"last_update_date": "2025-09-12T23:41:31.661000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for Autel MaxiCharger AC Wallbox Commercial Command Execution Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/704566"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14954"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-115",
"trust": 1.0
},
{
"problemtype": "Misinterpretation of input (CWE-115) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013672"
},
{
"db": "NVD",
"id": "CVE-2025-5826"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-25-345/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2025-5826"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14954"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013672"
},
{
"db": "NVD",
"id": "CVE-2025-5826"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-25-345"
},
{
"db": "CNVD",
"id": "CNVD-2025-14954"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013672"
},
{
"db": "NVD",
"id": "CVE-2025-5826"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-345"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14954"
},
{
"date": "2025-09-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2025-013672"
},
{
"date": "2025-06-25T18:15:23.433000",
"db": "NVD",
"id": "CVE-2025-5826"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-345"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14954"
},
{
"date": "2025-09-11T05:46:00",
"db": "JVNDB",
"id": "JVNDB-2025-013672"
},
{
"date": "2025-09-10T14:46:44.597000",
"db": "NVD",
"id": "CVE-2025-5826"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0autel\u00a0 Vulnerabilities related to misinterpretation of input in the product",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013672"
}
],
"trust": 0.8
}
}
VAR-202506-0586
Vulnerability from variot - Updated: 2025-09-12 19:40Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the Pile API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26352. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202506-0586",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc hipower",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac pro",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dh480",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger single charger",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact mobile",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac ultra",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac elite business c50",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc fast",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact pedestal",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial",
"scope": null,
"trust": 0.7,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.39.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.56.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-342"
},
{
"db": "CNVD",
"id": "CNVD-2025-14953"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013671"
},
{
"db": "NVD",
"id": "CVE-2025-6678"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)",
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-342"
}
],
"trust": 0.7
},
"cve": "CVE-2025-6678",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2025-14953",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2025-6678",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "OTHER",
"availabilityImpact": "None",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2025-013671",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "ZDI",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "ZDI-25-342",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2025-6678",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "OTHER",
"id": "JVNDB-2025-013671",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "ZDI-25-342",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2025-14953",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-342"
},
{
"db": "CNVD",
"id": "CNVD-2025-14953"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013671"
},
{
"db": "NVD",
"id": "CVE-2025-6678"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability. \n\nThe specific flaw exists within the Pile API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26352. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company",
"sources": [
{
"db": "NVD",
"id": "CVE-2025-6678"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013671"
},
{
"db": "ZDI",
"id": "ZDI-25-342"
},
{
"db": "CNVD",
"id": "CNVD-2025-14953"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2025-6678",
"trust": 3.2
},
{
"db": "ZDI",
"id": "ZDI-25-342",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013671",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-26352",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-14953",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-342"
},
{
"db": "CNVD",
"id": "CNVD-2025-14953"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013671"
},
{
"db": "NVD",
"id": "CVE-2025-6678"
}
]
},
"id": "VAR-202506-0586",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14953"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14953"
}
]
},
"last_update_date": "2025-09-12T19:40:30.151000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for Autel MaxiCharger AC Wallbox Commercial Access Control Error Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/704561"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14953"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-306",
"trust": 1.0
},
{
"problemtype": "Lack of authentication for critical features (CWE-306) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013671"
},
{
"db": "NVD",
"id": "CVE-2025-6678"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-25-342/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2025-6678"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14953"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013671"
},
{
"db": "NVD",
"id": "CVE-2025-6678"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-25-342"
},
{
"db": "CNVD",
"id": "CNVD-2025-14953"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013671"
},
{
"db": "NVD",
"id": "CVE-2025-6678"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-342"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14953"
},
{
"date": "2025-09-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2025-013671"
},
{
"date": "2025-06-25T18:15:25.507000",
"db": "NVD",
"id": "CVE-2025-6678"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-342"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14953"
},
{
"date": "2025-09-11T05:46:00",
"db": "JVNDB",
"id": "JVNDB-2025-013671"
},
{
"date": "2025-09-10T14:46:24.847000",
"db": "NVD",
"id": "CVE-2025-6678"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0autel\u00a0 Vulnerability related to lack of authentication for critical functions in the product",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013671"
}
],
"trust": 0.8
}
}
VAR-202506-0628
Vulnerability from variot - Updated: 2025-09-12 19:40Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of bluetooth pairing requests. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26353. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a same-origin policy violation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202506-0628",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact pedestal",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger single charger",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac ultra",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc fast",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc hipower",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dh480",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger ac pro",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger dc compact mobile",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.56.51"
},
{
"model": "maxicharger ac elite business c50",
"scope": "lt",
"trust": 1.0,
"vendor": "autel",
"version": "1.39.51"
},
{
"model": "maxicharger dc hipower",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac pro",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dh480",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger single charger",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact mobile",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac ultra",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac elite business c50",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc fast",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger dc compact pedestal",
"scope": null,
"trust": 0.8,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial",
"scope": null,
"trust": 0.7,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.39.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
},
{
"model": "maxicharger ac wallbox commercial \u003cv1.56.51",
"scope": null,
"trust": 0.6,
"vendor": "autel",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-343"
},
{
"db": "CNVD",
"id": "CNVD-2025-14951"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013673"
},
{
"db": "NVD",
"id": "CVE-2025-5824"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)",
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-343"
}
],
"trust": 0.7
},
"cve": "CVE-2025-5824",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.2,
"id": "CNVD-2025-14951",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "ADJACENT",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 1.6,
"id": "CVE-2025-5824",
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
{
"attackComplexity": "HIGH",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.6,
"id": "CVE-2025-5824",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "High",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2025-5824",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "HIGH",
"attackVector": "ADJACENT",
"author": "ZDI",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 1.6,
"id": "CVE-2025-5824",
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2025-5824",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2025-5824",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2025-5824",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2025-5824",
"trust": 0.7,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2025-14951",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-343"
},
{
"db": "CNVD",
"id": "CNVD-2025-14951"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013673"
},
{
"db": "NVD",
"id": "CVE-2025-5824"
},
{
"db": "NVD",
"id": "CVE-2025-5824"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. \n\nThe specific flaw exists within the handling of bluetooth pairing requests. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26353. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a same-origin policy violation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company",
"sources": [
{
"db": "NVD",
"id": "CVE-2025-5824"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013673"
},
{
"db": "ZDI",
"id": "ZDI-25-343"
},
{
"db": "CNVD",
"id": "CNVD-2025-14951"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2025-5824",
"trust": 3.9
},
{
"db": "ZDI",
"id": "ZDI-25-343",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013673",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-26353",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2025-14951",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-25-343"
},
{
"db": "CNVD",
"id": "CNVD-2025-14951"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013673"
},
{
"db": "NVD",
"id": "CVE-2025-5824"
}
]
},
"id": "VAR-202506-0628",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14951"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14951"
}
]
},
"last_update_date": "2025-09-12T19:40:30.124000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for Autel MaxiCharger AC Wallbox Commercial Authentication Bypass Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/704551"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14951"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-346",
"trust": 1.0
},
{
"problemtype": "Same-origin policy violation (CWE-346) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013673"
},
{
"db": "NVD",
"id": "CVE-2025-5824"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.zerodayinitiative.com/advisories/zdi-25-343/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2025-5824"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-14951"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013673"
},
{
"db": "NVD",
"id": "CVE-2025-5824"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-25-343"
},
{
"db": "CNVD",
"id": "CNVD-2025-14951"
},
{
"db": "JVNDB",
"id": "JVNDB-2025-013673"
},
{
"db": "NVD",
"id": "CVE-2025-5824"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-343"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14951"
},
{
"date": "2025-09-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2025-013673"
},
{
"date": "2025-06-25T18:15:23.173000",
"db": "NVD",
"id": "CVE-2025-5824"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-11T00:00:00",
"db": "ZDI",
"id": "ZDI-25-343"
},
{
"date": "2025-07-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-14951"
},
{
"date": "2025-09-11T05:46:00",
"db": "JVNDB",
"id": "JVNDB-2025-013673"
},
{
"date": "2025-09-10T14:46:54.780000",
"db": "NVD",
"id": "CVE-2025-5824"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0autel\u00a0 Same Origin Policy Violation Vulnerability in Products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2025-013673"
}
],
"trust": 0.8
}
}
CVE-2025-6678 (GCVE-0-2025-6678)
Vulnerability from nvd – Published: 2025-06-25 18:02 – Updated: 2025-06-25 19:20
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the Pile API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26352.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6678",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-25T19:19:55.574968Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T19:20:07.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-25T18:02:04.013Z",
"datePublic": "2025-06-11T17:27:06.576Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the Pile API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26352."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:02:09.371Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-342",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-342/"
}
],
"source": {
"lang": "en",
"value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"
},
"title": "Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-6678",
"datePublished": "2025-06-25T18:02:09.371Z",
"dateReserved": "2025-06-25T18:02:03.974Z",
"dateUpdated": "2025-06-25T19:20:07.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5830 (GCVE-0-2025-5830)
Vulnerability from nvd – Published: 2025-06-25 18:01 – Updated: 2025-06-26 13:16
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of DLB_SlaveRegister messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26327.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5830",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T13:16:25.684852Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T13:16:32.252Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:17:13.272Z",
"datePublic": "2025-06-11T17:27:46.341Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of DLB_SlaveRegister messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26327."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:01:20.050Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-349",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-349/"
}
],
"source": {
"lang": "en",
"value": "PHP Hooligans"
},
"title": "Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5830",
"datePublished": "2025-06-25T18:01:20.050Z",
"dateReserved": "2025-06-06T19:17:13.239Z",
"dateUpdated": "2025-06-26T13:16:32.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5829 (GCVE-0-2025-5829)
Vulnerability from nvd – Published: 2025-06-25 18:01 – Updated: 2025-06-26 13:16
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of JSON messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26330.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5829",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T13:16:43.440338Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T13:16:48.689Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:17:08.065Z",
"datePublic": "2025-06-11T17:27:35.696Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of JSON messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26330."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:01:13.334Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-348",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-348/"
}
],
"source": {
"lang": "en",
"value": "Tobias Scharnowski, Felix Buchmann, and Kristian Covic of fuzzware.io"
},
"title": "Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5829",
"datePublished": "2025-06-25T18:01:13.334Z",
"dateReserved": "2025-06-06T19:17:08.033Z",
"dateUpdated": "2025-06-26T13:16:48.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5828 (GCVE-0-2025-5828)
Vulnerability from nvd – Published: 2025-06-25 18:00 – Updated: 2025-06-26 13:18
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of USB frame packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26328.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5828",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T13:18:15.946259Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T13:18:21.495Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:17:04.884Z",
"datePublic": "2025-06-11T17:27:31.420Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of USB frame packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26328."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:00:44.220Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-347",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-347/"
}
],
"source": {
"lang": "en",
"value": "Synacktiv"
},
"title": "Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5828",
"datePublished": "2025-06-25T18:00:44.220Z",
"dateReserved": "2025-06-06T19:17:04.853Z",
"dateUpdated": "2025-06-26T13:18:21.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5827 (GCVE-0-2025-5827)
Vulnerability from nvd – Published: 2025-06-25 18:00 – Updated: 2025-06-26 13:17
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the ble_process_esp32_msg function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26369.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5827",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T13:17:14.944200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T13:17:21.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:17:00.448Z",
"datePublic": "2025-06-11T17:27:25.163Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the ble_process_esp32_msg function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26369."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:00:54.449Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-346",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-346/"
}
],
"source": {
"lang": "en",
"value": "Quarkslab"
},
"title": "Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5827",
"datePublished": "2025-06-25T18:00:54.449Z",
"dateReserved": "2025-06-06T19:17:00.418Z",
"dateUpdated": "2025-06-26T13:17:21.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5826 (GCVE-0-2025-5826)
Vulnerability from nvd – Published: 2025-06-25 18:00 – Updated: 2025-06-26 13:18
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-115 - Misinterpretation of Input
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5826",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T13:18:29.924076Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T13:18:35.182Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:16:55.452Z",
"datePublic": "2025-06-11T17:27:21.049Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-115",
"description": "CWE-115: Misinterpretation of Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:00:38.520Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-345",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-345/"
}
],
"source": {
"lang": "en",
"value": "Quarkslab"
},
"title": "Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5826",
"datePublished": "2025-06-25T18:00:38.520Z",
"dateReserved": "2025-06-06T19:16:55.415Z",
"dateUpdated": "2025-06-26T13:18:35.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5825 (GCVE-0-2025-5825)
Vulnerability from nvd – Published: 2025-06-25 18:02 – Updated: 2025-06-25 18:18
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.
The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a firmware image before using it to perform an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-26354.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1328 - Security Version Number Mutable to Older Versions
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5825",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-25T18:17:50.082273Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:18:01.073Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:16:51.093Z",
"datePublic": "2025-06-11T17:27:15.633Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a firmware image before using it to perform an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-26354."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1328",
"description": "CWE-1328: Security Version Number Mutable to Older Versions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:02:18.293Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-344",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-344/"
}
],
"source": {
"lang": "en",
"value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"
},
"title": "Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5825",
"datePublished": "2025-06-25T18:02:18.293Z",
"dateReserved": "2025-06-06T19:16:51.065Z",
"dateUpdated": "2025-06-25T18:18:01.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5824 (GCVE-0-2025-5824)
Vulnerability from nvd – Published: 2025-06-25 17:59 – Updated: 2025-06-25 18:21
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of bluetooth pairing requests. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26353.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-346 - Origin Validation Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5824",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-25T18:21:18.194673Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:21:28.310Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:16:45.821Z",
"datePublic": "2025-06-11T17:27:11.046Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of bluetooth pairing requests. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26353."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T17:59:54.446Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-343",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-343/"
}
],
"source": {
"lang": "en",
"value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"
},
"title": "Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5824",
"datePublished": "2025-06-25T17:59:54.446Z",
"dateReserved": "2025-06-06T19:16:45.792Z",
"dateUpdated": "2025-06-25T18:21:28.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5823 (GCVE-0-2025-5823)
Vulnerability from nvd – Published: 2025-06-25 18:01 – Updated: 2025-06-26 13:17
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.
The specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-749 - Exposed Dangerous Method or Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5823",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T13:16:57.354561Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T13:17:04.941Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:16:38.454Z",
"datePublic": "2025-06-11T17:27:01.850Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:01:07.948Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-341",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-341/"
}
],
"source": {
"lang": "en",
"value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"
},
"title": "Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5823",
"datePublished": "2025-06-25T18:01:07.948Z",
"dateReserved": "2025-06-06T19:16:38.423Z",
"dateUpdated": "2025-06-26T13:17:04.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5822 (GCVE-0-2025-5822)
Vulnerability from nvd – Published: 2025-06-25 18:00 – Updated: 2025-06-26 13:18
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability.
The specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5822",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T13:17:58.707658Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T13:18:05.218Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:16:34.709Z",
"datePublic": "2025-06-11T17:26:56.849Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:00:49.179Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-340",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-340/"
}
],
"source": {
"lang": "en",
"value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"
},
"title": "Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5822",
"datePublished": "2025-06-25T18:00:49.179Z",
"dateReserved": "2025-06-06T19:16:34.664Z",
"dateUpdated": "2025-06-26T13:18:05.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5825 (GCVE-0-2025-5825)
Vulnerability from cvelistv5 – Published: 2025-06-25 18:02 – Updated: 2025-06-25 18:18
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.
The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a firmware image before using it to perform an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-26354.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1328 - Security Version Number Mutable to Older Versions
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5825",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-25T18:17:50.082273Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:18:01.073Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:16:51.093Z",
"datePublic": "2025-06-11T17:27:15.633Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a firmware image before using it to perform an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-26354."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1328",
"description": "CWE-1328: Security Version Number Mutable to Older Versions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:02:18.293Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-344",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-344/"
}
],
"source": {
"lang": "en",
"value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"
},
"title": "Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5825",
"datePublished": "2025-06-25T18:02:18.293Z",
"dateReserved": "2025-06-06T19:16:51.065Z",
"dateUpdated": "2025-06-25T18:18:01.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-6678 (GCVE-0-2025-6678)
Vulnerability from cvelistv5 – Published: 2025-06-25 18:02 – Updated: 2025-06-25 19:20
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the Pile API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26352.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6678",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-25T19:19:55.574968Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T19:20:07.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-25T18:02:04.013Z",
"datePublic": "2025-06-11T17:27:06.576Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the Pile API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26352."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:02:09.371Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-342",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-342/"
}
],
"source": {
"lang": "en",
"value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"
},
"title": "Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-6678",
"datePublished": "2025-06-25T18:02:09.371Z",
"dateReserved": "2025-06-25T18:02:03.974Z",
"dateUpdated": "2025-06-25T19:20:07.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5830 (GCVE-0-2025-5830)
Vulnerability from cvelistv5 – Published: 2025-06-25 18:01 – Updated: 2025-06-26 13:16
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of DLB_SlaveRegister messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26327.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5830",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T13:16:25.684852Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T13:16:32.252Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:17:13.272Z",
"datePublic": "2025-06-11T17:27:46.341Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of DLB_SlaveRegister messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26327."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:01:20.050Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-349",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-349/"
}
],
"source": {
"lang": "en",
"value": "PHP Hooligans"
},
"title": "Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5830",
"datePublished": "2025-06-25T18:01:20.050Z",
"dateReserved": "2025-06-06T19:17:13.239Z",
"dateUpdated": "2025-06-26T13:16:32.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5829 (GCVE-0-2025-5829)
Vulnerability from cvelistv5 – Published: 2025-06-25 18:01 – Updated: 2025-06-26 13:16
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of JSON messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26330.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5829",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T13:16:43.440338Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T13:16:48.689Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:17:08.065Z",
"datePublic": "2025-06-11T17:27:35.696Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of JSON messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26330."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:01:13.334Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-348",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-348/"
}
],
"source": {
"lang": "en",
"value": "Tobias Scharnowski, Felix Buchmann, and Kristian Covic of fuzzware.io"
},
"title": "Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5829",
"datePublished": "2025-06-25T18:01:13.334Z",
"dateReserved": "2025-06-06T19:17:08.033Z",
"dateUpdated": "2025-06-26T13:16:48.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5823 (GCVE-0-2025-5823)
Vulnerability from cvelistv5 – Published: 2025-06-25 18:01 – Updated: 2025-06-26 13:17
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.
The specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-749 - Exposed Dangerous Method or Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5823",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T13:16:57.354561Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T13:17:04.941Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:16:38.454Z",
"datePublic": "2025-06-11T17:27:01.850Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:01:07.948Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-341",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-341/"
}
],
"source": {
"lang": "en",
"value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"
},
"title": "Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5823",
"datePublished": "2025-06-25T18:01:07.948Z",
"dateReserved": "2025-06-06T19:16:38.423Z",
"dateUpdated": "2025-06-26T13:17:04.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5827 (GCVE-0-2025-5827)
Vulnerability from cvelistv5 – Published: 2025-06-25 18:00 – Updated: 2025-06-26 13:17
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the ble_process_esp32_msg function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26369.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5827",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T13:17:14.944200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T13:17:21.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:17:00.448Z",
"datePublic": "2025-06-11T17:27:25.163Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the ble_process_esp32_msg function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26369."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:00:54.449Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-346",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-346/"
}
],
"source": {
"lang": "en",
"value": "Quarkslab"
},
"title": "Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5827",
"datePublished": "2025-06-25T18:00:54.449Z",
"dateReserved": "2025-06-06T19:17:00.418Z",
"dateUpdated": "2025-06-26T13:17:21.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5822 (GCVE-0-2025-5822)
Vulnerability from cvelistv5 – Published: 2025-06-25 18:00 – Updated: 2025-06-26 13:18
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability.
The specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5822",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T13:17:58.707658Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T13:18:05.218Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:16:34.709Z",
"datePublic": "2025-06-11T17:26:56.849Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:00:49.179Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-340",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-340/"
}
],
"source": {
"lang": "en",
"value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"
},
"title": "Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5822",
"datePublished": "2025-06-25T18:00:49.179Z",
"dateReserved": "2025-06-06T19:16:34.664Z",
"dateUpdated": "2025-06-26T13:18:05.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5828 (GCVE-0-2025-5828)
Vulnerability from cvelistv5 – Published: 2025-06-25 18:00 – Updated: 2025-06-26 13:18
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of USB frame packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26328.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5828",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T13:18:15.946259Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T13:18:21.495Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:17:04.884Z",
"datePublic": "2025-06-11T17:27:31.420Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of USB frame packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26328."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:00:44.220Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-347",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-347/"
}
],
"source": {
"lang": "en",
"value": "Synacktiv"
},
"title": "Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5828",
"datePublished": "2025-06-25T18:00:44.220Z",
"dateReserved": "2025-06-06T19:17:04.853Z",
"dateUpdated": "2025-06-26T13:18:21.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5826 (GCVE-0-2025-5826)
Vulnerability from cvelistv5 – Published: 2025-06-25 18:00 – Updated: 2025-06-26 13:18
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-115 - Misinterpretation of Input
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5826",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-26T13:18:29.924076Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-26T13:18:35.182Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:16:55.452Z",
"datePublic": "2025-06-11T17:27:21.049Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-115",
"description": "CWE-115: Misinterpretation of Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:00:38.520Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-345",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-345/"
}
],
"source": {
"lang": "en",
"value": "Quarkslab"
},
"title": "Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5826",
"datePublished": "2025-06-25T18:00:38.520Z",
"dateReserved": "2025-06-06T19:16:55.415Z",
"dateUpdated": "2025-06-26T13:18:35.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-5824 (GCVE-0-2025-5824)
Vulnerability from cvelistv5 – Published: 2025-06-25 17:59 – Updated: 2025-06-25 18:21
VLAI
EPSS
VEX
Title
Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability
Summary
Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of bluetooth pairing requests. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26353.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-346 - Origin Validation Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autel | Autel MaxiCharger AC Wallbox Commercial |
Affected:
1.36.00
|
Date Public
2025-06-11 17:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5824",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-25T18:21:18.194673Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T18:21:28.310Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Autel MaxiCharger AC Wallbox Commercial",
"vendor": "Autel",
"versions": [
{
"status": "affected",
"version": "1.36.00"
}
]
}
],
"dateAssigned": "2025-06-06T19:16:45.821Z",
"datePublic": "2025-06-11T17:27:11.046Z",
"descriptions": [
{
"lang": "en",
"value": "Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of bluetooth pairing requests. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26353."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T17:59:54.446Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-343",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-343/"
}
],
"source": {
"lang": "en",
"value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"
},
"title": "Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-5824",
"datePublished": "2025-06-25T17:59:54.446Z",
"dateReserved": "2025-06-06T19:16:45.792Z",
"dateUpdated": "2025-06-25T18:21:28.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}