Details of VAR-202506-0580

ID

VAR-202506-0580

CVE

CVE-2025-5822

TITLE

(Pwn2Own) Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability

Trust: 0.7

sources: ZDI: ZDI-25-340

DESCRIPTION

Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability. The specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company

Trust: 2.07

sources: NVD: CVE-2025-5822 // ZDI: ZDI-25-340 // CNVD: CNVD-2025-14950

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-14950

AFFECTED PRODUCTS

vendor:	autel	model:	maxicharger ac wallbox commercial	scope:	-	version:	-	Trust: 0.7
vendor:	autel	model:	maxicharger ac wallbox commercial <v1.39.51	scope:	-	version:	-	Trust: 0.6
vendor:	autel	model:	maxicharger ac wallbox commercial <v1.56.51	scope:	-	version:	-	Trust: 0.6

sources: ZDI: ZDI-25-340 // CNVD: CNVD-2025-14950

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com:	CVE-2025-5822
value:	HIGH
Trust: 1.0
ZDI:	CVE-2025-5822
value:	HIGH
Trust: 0.7
CNVD:	CNVD-2025-14950
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2025-14950
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:S/C:C/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	7.8
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

zdi-disclosures@trendmicro.com:	CVE-2025-5822
baseSeverity:	HIGH
baseScore:	7.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	4.2
version:	3.0
Trust: 1.0
ZDI:	CVE-2025-5822
baseSeverity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	4.2
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-25-340 // CNVD: CNVD-2025-14950 // NVD: CVE-2025-5822

PROBLEMTYPE DATA

problemtype:

CWE-863

Trust: 1.0

sources: NVD: CVE-2025-5822

PATCH

title:

Patch for Autel MaxiCharger AC Wallbox Commercial Privilege Escalation Vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/704546

Trust: 0.6

sources: CNVD: CNVD-2025-14950

EXTERNAL IDS

db:	NVD	id:	CVE-2025-5822	Trust: 2.3
db:	ZDI	id:	ZDI-25-340	Trust: 2.3
db:	ZDI_CAN	id:	ZDI-CAN-26325	Trust: 0.7
db:	CNVD	id:	CNVD-2025-14950	Trust: 0.6

sources: ZDI: ZDI-25-340 // CNVD: CNVD-2025-14950 // NVD: CVE-2025-5822

REFERENCES

url:

https://www.zerodayinitiative.com/advisories/zdi-25-340/

Trust: 1.6

sources: CNVD: CNVD-2025-14950 // NVD: CVE-2025-5822

CREDITS

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)

Trust: 0.7

sources: ZDI: ZDI-25-340

SOURCES

db:	ZDI	id:	ZDI-25-340
db:	CNVD	id:	CNVD-2025-14950
db:	NVD	id:	CVE-2025-5822

LAST UPDATE DATE

2025-07-04T23:46:31.608000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-25-340	date:	2025-06-11T00:00:00
db:	CNVD	id:	CNVD-2025-14950	date:	2025-07-03T00:00:00
db:	NVD	id:	CVE-2025-5822	date:	2025-06-26T18:57:43.670

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-25-340	date:	2025-06-11T00:00:00
db:	CNVD	id:	CNVD-2025-14950	date:	2025-07-03T00:00:00
db:	NVD	id:	CVE-2025-5822	date:	2025-06-25T18:15:22.900