CVE-2025-5826

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-5826
Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability : 2.8 / Impact : 3.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://www.zerodayinitiative.com/advisories/ZDI-25-345/ Third Party Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:h:autel:maxicharger_ac_elite_business_c50:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:o:autel:maxicharger_ac_pro_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_ac_pro_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:h:autel:maxicharger_ac_pro:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:o:autel:maxicharger_ac_ultra_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_ac_ultra_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:h:autel:maxicharger_ac_ultra:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
OR cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:h:autel:maxicharger_dc_compact_mobile:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
OR cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:h:autel:maxicharger_dc_compact_pedestal:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
OR cpe:2.3:o:autel:maxicharger_dc_fast_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_dc_fast_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:h:autel:maxicharger_dc_fast:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
OR cpe:2.3:o:autel:maxicharger_dc_hipower_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_dc_hipower_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:h:autel:maxicharger_dc_hipower:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
OR cpe:2.3:o:autel:maxicharger_dh480_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_dh480_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:h:autel:maxicharger_dh480:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
OR cpe:2.3:o:autel:maxicharger_single_charger_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_single_charger_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:h:autel:maxicharger_single_charger:-:*:*:*:*:*:*:*
History

10 Sep 2025, 14:46

Type Values Removed Values Added
CPE cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_ac_pro_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:h:autel:maxicharger_dh480:-:*:*:*:*:*:*:*
cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:h:autel:maxicharger_dc_fast:-:*:*:*:*:*:*:*
cpe:2.3:o:autel:maxicharger_dc_hipower_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_dc_fast_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:h:autel:maxicharger_ac_ultra:-:*:*:*:*:*:*:*
cpe:2.3:o:autel:maxicharger_single_charger_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_ac_ultra_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_single_charger_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:h:autel:maxicharger_ac_elite_business_c50:-:*:*:*:*:*:*:*
cpe:2.3:o:autel:maxicharger_ac_pro_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:h:autel:maxicharger_ac_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:autel:maxicharger_single_charger:-:*:*:*:*:*:*:*
cpe:2.3:o:autel:maxicharger_ac_ultra_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:h:autel:maxicharger_dc_compact_pedestal:-:*:*:*:*:*:*:*
cpe:2.3:o:autel:maxicharger_dc_fast_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:h:autel:maxicharger_dc_compact_mobile:-:*:*:*:*:*:*:*
cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:h:autel:maxicharger_dc_hipower:-:*:*:*:*:*:*:*
cpe:2.3:o:autel:maxicharger_dh480_firmware:*:*:*:*:*:*:*:european_standard
cpe:2.3:o:autel:maxicharger_dh480_firmware:*:*:*:*:*:*:*:american_standard
cpe:2.3:o:autel:maxicharger_dc_hipower_firmware:*:*:*:*:*:*:*:european_standard
First Time Autel maxicharger Single Charger Firmware
Autel maxicharger Ac Elite Business C50
Autel maxicharger Ac Pro Firmware
Autel
Autel maxicharger Dc Fast
Autel maxicharger Dc Compact Mobile Firmware
Autel maxicharger Ac Ultra Firmware
Autel maxicharger Dc Fast Firmware
Autel maxicharger Dc Hipower Firmware
Autel maxicharger Ac Pro
Autel maxicharger Dc Compact Mobile
Autel maxicharger Dh480 Firmware
Autel maxicharger Dc Compact Pedestal Firmware
Autel maxicharger Ac Elite Business C50 Firmware
Autel maxicharger Dh480
Autel maxicharger Single Charger
Autel maxicharger Ac Ultra
Autel maxicharger Dc Hipower
Autel maxicharger Dc Compact Pedestal
References () https://www.zerodayinitiative.com/advisories/ZDI-25-345/ - () https://www.zerodayinitiative.com/advisories/ZDI-25-345/ - Third Party Advisory

26 Jun 2025, 18:57

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de interpretación errónea de datos de entrada en Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg. Esta vulnerabilidad permite a atacantes adyacentes a la red inyectar comandos AT arbitrarios en las instalaciones afectadas de las estaciones de carga Autel MaxiCharger AC Wallbox Commercial. No se requiere autenticación para explotar esta vulnerabilidad. La falla específica se encuentra en la función ble_process_esp32_msg. El problema se debe a la interpretación errónea de los datos de entrada. Un atacante puede aprovechar esta vulnerabilidad para ejecutar comandos AT en el contexto del dispositivo. Anteriormente, se denominó ZDI-CAN-26368.

25 Jun 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-25 18:15

Updated : 2025-09-10 14:46

NVD link : CVE-2025-5826

Mitre link : CVE-2025-5826

CVE.ORG link : CVE-2025-5826

JSON object : View

Products Affected

autel

  • maxicharger_ac_ultra
  • maxicharger_dc_hipower_firmware
  • maxicharger_ac_elite_business_c50
  • maxicharger_ac_pro_firmware
  • maxicharger_ac_elite_business_c50_firmware
  • maxicharger_dc_hipower
  • maxicharger_dc_compact_mobile
  • maxicharger_dc_fast_firmware
  • maxicharger_dc_compact_mobile_firmware
  • maxicharger_dh480
  • maxicharger_single_charger_firmware
  • maxicharger_dc_compact_pedestal
  • maxicharger_dc_fast
  • maxicharger_ac_ultra_firmware
  • maxicharger_ac_pro
  • maxicharger_dc_compact_pedestal_firmware
  • maxicharger_dh480_firmware
  • maxicharger_single_charger
CWE
CWE-115

Misinterpretation of Input