CVE-2025-5823 - Vulnerability Details

- Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability

Description

Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351.

Published: 2025-06-25

Score: 6.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Autel

Autel MaxiCharger AC Wallbox Commercial

unknown

Version	Status	Constraints
`1.36.00`	affected	—

Configuration 1 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_ac_elite_business_c50:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_ac_pro_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_ac_pro_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_ac_pro:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_ac_ultra_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_ac_ultra_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_ac_ultra:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_dc_compact_mobile:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_dc_compact_pedestal:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_dc_fast_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_dc_fast_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_dc_fast:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_dc_hipower_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_dc_hipower_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_dc_hipower:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_dh480_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_dh480_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_dh480:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_single_charger_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_single_charger_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_single_charger:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2025-28666	Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00144.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.zerodayinitiative.com/advisories/ZDI-25-341/

History

Wed, 10 Sep 2025 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Autel Autel maxicharger Ac Elite Business C50 Autel maxicharger Ac Elite Business C50 Firmware Autel maxicharger Ac Pro Autel maxicharger Ac Pro Firmware Autel maxicharger Ac Ultra Autel maxicharger Ac Ultra Firmware Autel maxicharger Dc Compact Mobile Autel maxicharger Dc Compact Mobile Firmware Autel maxicharger Dc Compact Pedestal Autel maxicharger Dc Compact Pedestal Firmware Autel maxicharger Dc Fast Autel maxicharger Dc Fast Firmware Autel maxicharger Dc Hipower Autel maxicharger Dc Hipower Firmware Autel maxicharger Dh480 Autel maxicharger Dh480 Firmware Autel maxicharger Single Charger Autel maxicharger Single Charger Firmware
CPEs		cpe:2.3:h:autel:maxicharger_ac_elite_business_c50:-:::::::* cpe:2.3:h:autel:maxicharger_ac_pro:-:::::::* cpe:2.3:h:autel:maxicharger_ac_ultra:-:::::::* cpe:2.3:h:autel:maxicharger_dc_compact_mobile:-:::::::* cpe:2.3:h:autel:maxicharger_dc_compact_pedestal:-:::::::* cpe:2.3:h:autel:maxicharger_dc_fast:-:::::::* cpe:2.3:h:autel:maxicharger_dc_hipower:-:::::::* cpe:2.3:h:autel:maxicharger_dh480:-:::::::* cpe:2.3:h:autel:maxicharger_single_charger:-:::::::* cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_ac_pro_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_ac_pro_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_ac_ultra_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_ac_ultra_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_dc_fast_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_dc_fast_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_dc_hipower_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_dc_hipower_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_dh480_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_dh480_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_single_charger_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_single_charger_firmware::::::::european_standard
Vendors & Products		Autel Autel maxicharger Ac Elite Business C50 Autel maxicharger Ac Elite Business C50 Firmware Autel maxicharger Ac Pro Autel maxicharger Ac Pro Firmware Autel maxicharger Ac Ultra Autel maxicharger Ac Ultra Firmware Autel maxicharger Dc Compact Mobile Autel maxicharger Dc Compact Mobile Firmware Autel maxicharger Dc Compact Pedestal Autel maxicharger Dc Compact Pedestal Firmware Autel maxicharger Dc Fast Autel maxicharger Dc Fast Firmware Autel maxicharger Dc Hipower Autel maxicharger Dc Hipower Firmware Autel maxicharger Dh480 Autel maxicharger Dh480 Firmware Autel maxicharger Single Charger Autel maxicharger Single Charger Firmware
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

Thu, 26 Jun 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 25 Jun 2025 18:15:00 +0000

Type	Values Removed	Values Added
Description		Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351.
Title		Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability
Weaknesses		CWE-749
References		https://www.zerodayinitiative.com/advisories/ZDI-25-341/
Metrics		cvssV3_0 `{'score': 4.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}`

Subscriptions

Autel Maxicharger Ac Elite Business C50 Maxicharger Ac Elite Business C50 Firmware Maxicharger Ac Pro Maxicharger Ac Pro Firmware Maxicharger Ac Ultra Maxicharger Ac Ultra Firmware Maxicharger Dc Compact Mobile Maxicharger Dc Compact Mobile Firmware Maxicharger Dc Compact Pedestal Maxicharger Dc Compact Pedestal Firmware Maxicharger Dc Fast Maxicharger Dc Fast Firmware Maxicharger Dc Hipower Maxicharger Dc Hipower Firmware Maxicharger Dh480 Maxicharger Dh480 Firmware Maxicharger Single Charger Maxicharger Single Charger Firmware

MITRE

Status: PUBLISHED

Assigner: zdi

Published: 2025-06-25T18:01:07.948Z

Updated: 2025-06-26T13:17:04.941Z

Reserved: 2025-06-06T19:16:38.423Z

Link: CVE-2025-5823

Vulnrichment

Updated: 2025-06-26T13:17:01.195Z

NVD

Status : Analyzed

Published: 2025-06-25T18:15:23.043

Modified: 2025-09-10T14:46:52.680

Link: CVE-2025-5823

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-749

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object