CVE-2025-5826
BaseFortify
Publication date: 2025-06-25
Last updated on: 2025-09-10
Assigner: Zero Day Initiative
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| autel | maxicharger_ac_elite_business_c50_firmware | to 1.39.51 (exc) |
| autel | maxicharger_ac_elite_business_c50_firmware | to 1.56.51 (exc) |
| autel | maxicharger_ac_elite_business_c50 | * |
| autel | maxicharger_ac_pro_firmware | to 1.39.51 (exc) |
| autel | maxicharger_ac_pro_firmware | to 1.56.51 (exc) |
| autel | maxicharger_ac_pro | * |
| autel | maxicharger_ac_ultra_firmware | to 1.39.51 (exc) |
| autel | maxicharger_ac_ultra_firmware | to 1.56.51 (exc) |
| autel | maxicharger_ac_ultra | * |
| autel | maxicharger_dc_compact_mobile_firmware | to 1.39.51 (exc) |
| autel | maxicharger_dc_compact_mobile_firmware | to 1.56.51 (exc) |
| autel | maxicharger_dc_compact_mobile | * |
| autel | maxicharger_dc_compact_pedestal_firmware | to 1.39.51 (exc) |
| autel | maxicharger_dc_compact_pedestal_firmware | to 1.56.51 (exc) |
| autel | maxicharger_dc_compact_pedestal | * |
| autel | maxicharger_dc_fast_firmware | to 1.39.51 (exc) |
| autel | maxicharger_dc_fast_firmware | to 1.56.51 (exc) |
| autel | maxicharger_dc_fast | * |
| autel | maxicharger_dc_hipower_firmware | to 1.39.51 (exc) |
| autel | maxicharger_dc_hipower_firmware | to 1.56.51 (exc) |
| autel | maxicharger_dc_hipower | * |
| autel | maxicharger_dh480_firmware | to 1.39.51 (exc) |
| autel | maxicharger_dh480_firmware | to 1.56.51 (exc) |
| autel | maxicharger_dh480 | * |
| autel | maxicharger_single_charger_firmware | to 1.39.51 (exc) |
| autel | maxicharger_single_charger_firmware | to 1.56.51 (exc) |
| autel | maxicharger_single_charger | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-115 | The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Autel MaxiCharger AC Wallbox Commercial charging stations within the ble_process_esp32_msg function. It is caused by a misinterpretation of input data, allowing network-adjacent attackers to inject arbitrary AT commands into the device without needing authentication. This enables the attacker to execute commands in the context of the device. [1]
How can this vulnerability impact me? :
Exploiting this vulnerability can allow an attacker to execute arbitrary commands on the affected charging station, potentially impacting the confidentiality, integrity, and availability of the device to a limited extent. This could lead to unauthorized control or disruption of the charging station's operation. [1]