Details of VAR-202506-0628

ID

VAR-202506-0628

CVE

CVE-2025-5824

TITLE

plural autel Same Origin Policy Violation Vulnerability in Products

Trust: 0.8

sources: JVNDB: JVNDB-2025-013673

DESCRIPTION

Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of bluetooth pairing requests. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26353. maxicharger ac elite business c50 firmware, MaxiCharger AC Pro firmware, MaxiCharger AC Ultra firmware etc. autel The product contains a same-origin policy violation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Autel MaxiCharger AC Wallbox Commercial is a smart AI electric vehicle charger from Autel, a US company

Trust: 2.79

sources: NVD: CVE-2025-5824 // JVNDB: JVNDB-2025-013673 // ZDI: ZDI-25-343 // CNVD: CNVD-2025-14951

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-14951

AFFECTED PRODUCTS

vendor:	autel	model:	maxicharger ac ultra	scope:	lt	version:	1.56.51	Trust: 1.0
vendor:	autel	model:	maxicharger dc compact pedestal	scope:	lt	version:	1.56.51	Trust: 1.0
vendor:	autel	model:	maxicharger dc fast	scope:	lt	version:	1.56.51	Trust: 1.0
vendor:	autel	model:	maxicharger dc compact mobile	scope:	lt	version:	1.39.51	Trust: 1.0
vendor:	autel	model:	maxicharger dh480	scope:	lt	version:	1.56.51	Trust: 1.0
vendor:	autel	model:	maxicharger dc hipower	scope:	lt	version:	1.39.51	Trust: 1.0
vendor:	autel	model:	maxicharger single charger	scope:	lt	version:	1.39.51	Trust: 1.0
vendor:	autel	model:	maxicharger ac pro	scope:	lt	version:	1.39.51	Trust: 1.0
vendor:	autel	model:	maxicharger ac elite business c50	scope:	lt	version:	1.56.51	Trust: 1.0
vendor:	autel	model:	maxicharger dc compact pedestal	scope:	lt	version:	1.39.51	Trust: 1.0
vendor:	autel	model:	maxicharger single charger	scope:	lt	version:	1.56.51	Trust: 1.0
vendor:	autel	model:	maxicharger ac ultra	scope:	lt	version:	1.39.51	Trust: 1.0
vendor:	autel	model:	maxicharger dc fast	scope:	lt	version:	1.39.51	Trust: 1.0
vendor:	autel	model:	maxicharger dc hipower	scope:	lt	version:	1.56.51	Trust: 1.0
vendor:	autel	model:	maxicharger dh480	scope:	lt	version:	1.39.51	Trust: 1.0
vendor:	autel	model:	maxicharger ac pro	scope:	lt	version:	1.56.51	Trust: 1.0
vendor:	autel	model:	maxicharger dc compact mobile	scope:	lt	version:	1.56.51	Trust: 1.0
vendor:	autel	model:	maxicharger ac elite business c50	scope:	lt	version:	1.39.51	Trust: 1.0
vendor:	autel	model:	maxicharger dc hipower	scope:	-	version:	-	Trust: 0.8
vendor:	autel	model:	maxicharger ac pro	scope:	-	version:	-	Trust: 0.8
vendor:	autel	model:	maxicharger dh480	scope:	-	version:	-	Trust: 0.8
vendor:	autel	model:	maxicharger single charger	scope:	-	version:	-	Trust: 0.8
vendor:	autel	model:	maxicharger dc compact mobile	scope:	-	version:	-	Trust: 0.8
vendor:	autel	model:	maxicharger ac ultra	scope:	-	version:	-	Trust: 0.8
vendor:	autel	model:	maxicharger ac elite business c50	scope:	-	version:	-	Trust: 0.8
vendor:	autel	model:	maxicharger dc fast	scope:	-	version:	-	Trust: 0.8
vendor:	autel	model:	maxicharger dc compact pedestal	scope:	-	version:	-	Trust: 0.8
vendor:	autel	model:	maxicharger ac wallbox commercial	scope:	-	version:	-	Trust: 0.7
vendor:	autel	model:	maxicharger ac wallbox commercial <v1.39.51	scope:	-	version:	-	Trust: 0.6
vendor:	autel	model:	maxicharger ac wallbox commercial <v1.56.51	scope:	-	version:	-	Trust: 0.6

sources: ZDI: ZDI-25-343 // CNVD: CNVD-2025-14951 // JVNDB: JVNDB-2025-013673 // NVD: CVE-2025-5824

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com:	CVE-2025-5824
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2025-5824
value:	HIGH
Trust: 1.0
NVD:	CVE-2025-5824
value:	HIGH
Trust: 0.8
ZDI:	CVE-2025-5824
value:	MEDIUM
Trust: 0.7
CNVD:	CNVD-2025-14951
value:	MEDIUM
Trust: 0.6

CNVD:	CNVD-2025-14951
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:A/AC:H/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.2
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

zdi-disclosures@trendmicro.com:	CVE-2025-5824
baseSeverity:	MEDIUM
baseScore:	5.0
vectorString:	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector:	ADJACENT
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	1.6
impactScore:	3.4
version:	3.0
Trust: 1.0
nvd@nist.gov:	CVE-2025-5824
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.6
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2025-5824
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8
ZDI:	CVE-2025-5824
baseSeverity:	MEDIUM
baseScore:	5.0
vectorString:	AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector:	ADJACENT
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	1.6
impactScore:	3.4
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-25-343 // CNVD: CNVD-2025-14951 // JVNDB: JVNDB-2025-013673 // NVD: CVE-2025-5824 // NVD: CVE-2025-5824

PROBLEMTYPE DATA

problemtype:	CWE-346	Trust: 1.0
problemtype:	Same-origin policy violation (CWE-346) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-013673 // NVD: CVE-2025-5824

PATCH

title:

Patch for Autel MaxiCharger AC Wallbox Commercial Authentication Bypass Vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/704551

Trust: 0.6

sources: CNVD: CNVD-2025-14951

EXTERNAL IDS

db:	NVD	id:	CVE-2025-5824	Trust: 3.9
db:	ZDI	id:	ZDI-25-343	Trust: 3.1
db:	JVNDB	id:	JVNDB-2025-013673	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-26353	Trust: 0.7
db:	CNVD	id:	CNVD-2025-14951	Trust: 0.6

sources: ZDI: ZDI-25-343 // CNVD: CNVD-2025-14951 // JVNDB: JVNDB-2025-013673 // NVD: CVE-2025-5824

REFERENCES

url:	https://www.zerodayinitiative.com/advisories/zdi-25-343/	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2025-5824	Trust: 0.8

sources: CNVD: CNVD-2025-14951 // JVNDB: JVNDB-2025-013673 // NVD: CVE-2025-5824

CREDITS

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)

Trust: 0.7

sources: ZDI: ZDI-25-343

SOURCES

db:	ZDI	id:	ZDI-25-343
db:	CNVD	id:	CNVD-2025-14951
db:	JVNDB	id:	JVNDB-2025-013673
db:	NVD	id:	CVE-2025-5824

LAST UPDATE DATE

2025-09-12T19:40:30.124000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-25-343	date:	2025-06-11T00:00:00
db:	CNVD	id:	CNVD-2025-14951	date:	2025-07-03T00:00:00
db:	JVNDB	id:	JVNDB-2025-013673	date:	2025-09-11T05:46:00
db:	NVD	id:	CVE-2025-5824	date:	2025-09-10T14:46:54.780

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-25-343	date:	2025-06-11T00:00:00
db:	CNVD	id:	CNVD-2025-14951	date:	2025-07-03T00:00:00
db:	JVNDB	id:	JVNDB-2025-013673	date:	2025-09-11T00:00:00
db:	NVD	id:	CVE-2025-5824	date:	2025-06-25T18:15:23.173