CVE-2025-5824 - Vulnerability Details

- Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability

Description

Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of bluetooth pairing requests. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26353.

Published: 2025-06-25

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Autel

Autel MaxiCharger AC Wallbox Commercial

unknown

Version	Status	Constraints
`1.36.00`	affected	—

Configuration 1 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_ac_elite_business_c50:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_ac_pro_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_ac_pro_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_ac_pro:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_ac_ultra_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_ac_ultra_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_ac_ultra:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_dc_compact_mobile:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_dc_compact_pedestal:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_dc_fast_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_dc_fast_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_dc_fast:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_dc_hipower_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_dc_hipower_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_dc_hipower:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_dh480_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_dh480_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_dh480:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

OR	cpe:2.3:o:autel:maxicharger_single_charger_firmware:::::::*:american_standard
	cpe:2.3:o:autel:maxicharger_single_charger_firmware:::::::*:european_standard

cpe:2.3:h:autel:maxicharger_single_charger:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2025-19124	Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of bluetooth pairing requests. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26353.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00009.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.zerodayinitiative.com/advisories/ZDI-25-343/

History

Wed, 10 Sep 2025 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Autel Autel maxicharger Ac Elite Business C50 Autel maxicharger Ac Elite Business C50 Firmware Autel maxicharger Ac Pro Autel maxicharger Ac Pro Firmware Autel maxicharger Ac Ultra Autel maxicharger Ac Ultra Firmware Autel maxicharger Dc Compact Mobile Autel maxicharger Dc Compact Mobile Firmware Autel maxicharger Dc Compact Pedestal Autel maxicharger Dc Compact Pedestal Firmware Autel maxicharger Dc Fast Autel maxicharger Dc Fast Firmware Autel maxicharger Dc Hipower Autel maxicharger Dc Hipower Firmware Autel maxicharger Dh480 Autel maxicharger Dh480 Firmware Autel maxicharger Single Charger Autel maxicharger Single Charger Firmware
CPEs		cpe:2.3:h:autel:maxicharger_ac_elite_business_c50:-:::::::* cpe:2.3:h:autel:maxicharger_ac_pro:-:::::::* cpe:2.3:h:autel:maxicharger_ac_ultra:-:::::::* cpe:2.3:h:autel:maxicharger_dc_compact_mobile:-:::::::* cpe:2.3:h:autel:maxicharger_dc_compact_pedestal:-:::::::* cpe:2.3:h:autel:maxicharger_dc_fast:-:::::::* cpe:2.3:h:autel:maxicharger_dc_hipower:-:::::::* cpe:2.3:h:autel:maxicharger_dh480:-:::::::* cpe:2.3:h:autel:maxicharger_single_charger:-:::::::* cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_ac_pro_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_ac_pro_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_ac_ultra_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_ac_ultra_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_dc_fast_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_dc_fast_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_dc_hipower_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_dc_hipower_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_dh480_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_dh480_firmware::::::::european_standard cpe:2.3:o:autel:maxicharger_single_charger_firmware::::::::american_standard cpe:2.3:o:autel:maxicharger_single_charger_firmware::::::::european_standard
Vendors & Products		Autel Autel maxicharger Ac Elite Business C50 Autel maxicharger Ac Elite Business C50 Firmware Autel maxicharger Ac Pro Autel maxicharger Ac Pro Firmware Autel maxicharger Ac Ultra Autel maxicharger Ac Ultra Firmware Autel maxicharger Dc Compact Mobile Autel maxicharger Dc Compact Mobile Firmware Autel maxicharger Dc Compact Pedestal Autel maxicharger Dc Compact Pedestal Firmware Autel maxicharger Dc Fast Autel maxicharger Dc Fast Firmware Autel maxicharger Dc Hipower Autel maxicharger Dc Hipower Firmware Autel maxicharger Dh480 Autel maxicharger Dh480 Firmware Autel maxicharger Single Charger Autel maxicharger Single Charger Firmware
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 25 Jun 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 25 Jun 2025 18:15:00 +0000

Type	Values Removed	Values Added
Description		Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of bluetooth pairing requests. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26353.
Title		Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability
Weaknesses		CWE-346
References		https://www.zerodayinitiative.com/advisories/ZDI-25-343/
Metrics		cvssV3_0 `{'score': 5, 'vector': 'CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'}`

Subscriptions

Autel Maxicharger Ac Elite Business C50 Maxicharger Ac Elite Business C50 Firmware Maxicharger Ac Pro Maxicharger Ac Pro Firmware Maxicharger Ac Ultra Maxicharger Ac Ultra Firmware Maxicharger Dc Compact Mobile Maxicharger Dc Compact Mobile Firmware Maxicharger Dc Compact Pedestal Maxicharger Dc Compact Pedestal Firmware Maxicharger Dc Fast Maxicharger Dc Fast Firmware Maxicharger Dc Hipower Maxicharger Dc Hipower Firmware Maxicharger Dh480 Maxicharger Dh480 Firmware Maxicharger Single Charger Maxicharger Single Charger Firmware

MITRE

Status: PUBLISHED

Assigner: zdi

Published: 2025-06-25T17:59:54.446Z

Updated: 2025-06-25T18:21:28.310Z

Reserved: 2025-06-06T19:16:45.792Z

Link: CVE-2025-5824

Vulnrichment

Updated: 2025-06-25T18:21:21.172Z

NVD

Status : Analyzed

Published: 2025-06-25T18:15:23.173

Modified: 2025-09-10T14:46:54.780

Link: CVE-2025-5824

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-346

Tracking

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object