Details of VAR-202506-0627

ID

VAR-202506-0627

CVE

CVE-2025-5825

TITLE

(Pwn2Own) Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-25-344

DESCRIPTION

Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a firmware image before using it to perform an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-26354. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company

Trust: 2.07

sources: NVD: CVE-2025-5825 // ZDI: ZDI-25-344 // CNVD: CNVD-2025-14949

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-14949

AFFECTED PRODUCTS

vendor:	autel	model:	maxicharger ac wallbox commercial	scope:	-	version:	-	Trust: 0.7
vendor:	autel	model:	maxicharger ac wallbox commercial <v1.39.51	scope:	-	version:	-	Trust: 0.6
vendor:	autel	model:	maxicharger ac wallbox commercial <v1.56.51	scope:	-	version:	-	Trust: 0.6

sources: ZDI: ZDI-25-344 // CNVD: CNVD-2025-14949

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com:	CVE-2025-5825
value:	HIGH
Trust: 1.0
ZDI:	CVE-2025-5825
value:	HIGH
Trust: 0.7
CNVD:	CNVD-2025-14949
value:	MEDIUM
Trust: 0.6

CNVD:	CNVD-2025-14949
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:A/AC:H/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.2
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

zdi-disclosures@trendmicro.com:	CVE-2025-5825
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.6
impactScore:	5.9
version:	3.0
Trust: 1.0
ZDI:	CVE-2025-5825
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.6
impactScore:	5.9
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-25-344 // CNVD: CNVD-2025-14949 // NVD: CVE-2025-5825

PROBLEMTYPE DATA

problemtype:

CWE-1328

Trust: 1.0

sources: NVD: CVE-2025-5825

PATCH

title:

Patch for Autel MaxiCharger AC Wallbox Commercial Code Execution Vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/704541

Trust: 0.6

sources: CNVD: CNVD-2025-14949

EXTERNAL IDS

db:	NVD	id:	CVE-2025-5825	Trust: 2.3
db:	ZDI	id:	ZDI-25-344	Trust: 2.3
db:	ZDI_CAN	id:	ZDI-CAN-26354	Trust: 0.7
db:	CNVD	id:	CNVD-2025-14949	Trust: 0.6

sources: ZDI: ZDI-25-344 // CNVD: CNVD-2025-14949 // NVD: CVE-2025-5825

REFERENCES

url:

https://www.zerodayinitiative.com/advisories/zdi-25-344/

Trust: 1.6

sources: CNVD: CNVD-2025-14949 // NVD: CVE-2025-5825

CREDITS

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)

Trust: 0.7

sources: ZDI: ZDI-25-344

SOURCES

db:	ZDI	id:	ZDI-25-344
db:	CNVD	id:	CNVD-2025-14949
db:	NVD	id:	CVE-2025-5825

LAST UPDATE DATE

2025-07-04T23:40:47.580000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-25-344	date:	2025-06-11T00:00:00
db:	CNVD	id:	CNVD-2025-14949	date:	2025-07-03T00:00:00
db:	NVD	id:	CVE-2025-5825	date:	2025-06-26T18:57:43.670

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-25-344	date:	2025-06-11T00:00:00
db:	CNVD	id:	CNVD-2025-14949	date:	2025-07-03T00:00:00
db:	NVD	id:	CVE-2025-5825	date:	2025-06-25T18:15:23.303