CVE Feed

    Dashboard / CVE / CVE-2025-5822

    CVE-2025-5822

    Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability. The specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325.

    Published:Jun 25, 2025
    Last Modified:Sep 10, 2025
    EPS:Jun 25, 2025
    EPSS Score:0.00059
    CVSS Score:8.8

    Affected Products

    Vendor
    Autel
    Product
    Maxicharger Ac Elite Business C50
    Vendor
    Autel
    Product
    Maxicharger Ac Elite Business C50 Firmware
    Vendor
    Autel
    Product
    Maxicharger Ac Pro
    Vendor
    Autel
    Product
    Maxicharger Ac Pro Firmware
    Vendor
    Autel
    Product
    Maxicharger Ac Ultra
    Vendor
    Autel
    Product
    Maxicharger Ac Ultra Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Mobile
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Mobile Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Pedestal
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Pedestal Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Fast
    Vendor
    Autel
    Product
    Maxicharger Dc Fast Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Hipower
    Vendor
    Autel
    Product
    Maxicharger Dc Hipower Firmware
    Vendor
    Autel
    Product
    Maxicharger Dh480
    Vendor
    Autel
    Product
    Maxicharger Dh480 Firmware
    Vendor
    Autel
    Product
    Maxicharger Single Charger
    Vendor
    Autel
    Product
    Maxicharger Single Charger Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-5825 (CVSS 7.5) — Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerabi…
    CVE-2025-6678 (CVSS 7.5) — Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This …
    CVE-2025-5830 (CVSS 8.8) — Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vul…
    CVE-2025-5829 (CVSS 6.8) — Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerabi…
    CVE-2025-5823 (CVSS 6.5) — Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerab…
    CVE-2025-5827 (CVSS 8.8) — Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Executio…
    CVE-2025-5828 (CVSS 6.8) — Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vuln…
    CVE-2025-5826 (CVSS 6.3) — Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This v…
    CVE-2025-5824 (CVSS 7.5) — Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vuln…
    CVE-2024-23959 (CVSS 8) — Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl Stack-based Buffer Overflow Remote Code Executi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High