CVE-2025-5822

{"id": "CVE-2025-5822", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "published": "2025-06-25T18:15:22.900", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-340/", "source": "zdi-disclosures@trendmicro.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "zdi-disclosures@trendmicro.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325."}, {"lang": "es", "value": "Vulnerabilidad de escalada de privilegios de autorizaci\u00f3n incorrecta en la API de Autel MaxiCharger AC Wallbox Commercial Technician. Esta vulnerabilidad permite a atacantes remotos escalar privilegios en las instalaciones afectadas de las estaciones de carga Autel MaxiCharger AC Wallbox Commercial. Para explotar esta vulnerabilidad, un atacante debe obtener primero un token de autorizaci\u00f3n con privilegios bajos. La falla espec\u00edfica se encuentra en la implementaci\u00f3n de la API de Autel Technician. El problema se debe a una autorizaci\u00f3n incorrecta. Un atacante puede aprovechar esta vulnerabilidad para escalar privilegios a recursos que normalmente estar\u00edan protegidos del usuario. La vulnerabilidad era ZDI-CAN-26325."}], "lastModified": "2025-06-26T18:57:43.670", "sourceIdentifier": "zdi-disclosures@trendmicro.com"}