Sign-up

ID

VAR-202506-0609


CVE

CVE-2025-5826


TITLE

(Pwn2Own) Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability

Trust: 0.7

sources: ZDI: ZDI-25-345

DESCRIPTION

Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, an American company

Trust: 2.07

sources: NVD: CVE-2025-5826 // ZDI: ZDI-25-345 // CNVD: CNVD-2025-14954

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-14954

AFFECTED PRODUCTS

vendor:autelmodel:maxicharger ac wallbox commercialscope: - version: -

Trust: 0.7

vendor:autelmodel:maxicharger ac wallbox commercial <v1.39.51scope: - version: -

Trust: 0.6

vendor:autelmodel:maxicharger ac wallbox commercial <v1.56.51scope: - version: -

Trust: 0.6

sources: ZDI: ZDI-25-345 // CNVD: CNVD-2025-14954

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2025-5826
value: MEDIUM

Trust: 1.0

ZDI: CVE-2025-5826
value: MEDIUM

Trust: 0.7

CNVD: CNVD-2025-14954
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2025-14954
severity: MEDIUM
baseScore: 5.8
vectorString: AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2025-5826
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 3.4
version: 3.0

Trust: 1.0

ZDI: CVE-2025-5826
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 3.4
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-25-345 // CNVD: CNVD-2025-14954 // NVD: CVE-2025-5826

PROBLEMTYPE DATA

problemtype:CWE-115

Trust: 1.0

sources: NVD: CVE-2025-5826

PATCH

title:Patch for Autel MaxiCharger AC Wallbox Commercial Command Execution Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/704566

Trust: 0.6

sources: CNVD: CNVD-2025-14954

EXTERNAL IDS

db:NVDid:CVE-2025-5826

Trust: 2.3

db:ZDIid:ZDI-25-345

Trust: 2.3

db:ZDI_CANid:ZDI-CAN-26368

Trust: 0.7

db:CNVDid:CNVD-2025-14954

Trust: 0.6

sources: ZDI: ZDI-25-345 // CNVD: CNVD-2025-14954 // NVD: CVE-2025-5826

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-25-345/

Trust: 1.6

sources: CNVD: CNVD-2025-14954 // NVD: CVE-2025-5826

CREDITS

Quarkslab

Trust: 0.7

sources: ZDI: ZDI-25-345

SOURCES

db:ZDIid:ZDI-25-345
db:CNVDid:CNVD-2025-14954
db:NVDid:CVE-2025-5826

LAST UPDATE DATE

2025-07-04T23:44:24.409000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-25-345date:2025-06-11T00:00:00
db:CNVDid:CNVD-2025-14954date:2025-07-03T00:00:00
db:NVDid:CVE-2025-5826date:2025-06-26T18:57:43.670

SOURCES RELEASE DATE

db:ZDIid:ZDI-25-345date:2025-06-11T00:00:00
db:CNVDid:CNVD-2025-14954date:2025-07-03T00:00:00
db:NVDid:CVE-2025-5826date:2025-06-25T18:15:23.433