CVE Feed

    Dashboard / CVE / CVE-2025-5823

    CVE-2025-5823

    Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351.

    Published:Jun 25, 2025
    Last Modified:Sep 10, 2025
    EPS:Jun 25, 2025
    EPSS Score:0.0034
    CVSS Score:6.5

    Affected Products

    Vendor
    Autel
    Product
    Maxicharger Ac Elite Business C50
    Vendor
    Autel
    Product
    Maxicharger Ac Elite Business C50 Firmware
    Vendor
    Autel
    Product
    Maxicharger Ac Pro
    Vendor
    Autel
    Product
    Maxicharger Ac Pro Firmware
    Vendor
    Autel
    Product
    Maxicharger Ac Ultra
    Vendor
    Autel
    Product
    Maxicharger Ac Ultra Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Mobile
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Mobile Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Pedestal
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Pedestal Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Fast
    Vendor
    Autel
    Product
    Maxicharger Dc Fast Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Hipower
    Vendor
    Autel
    Product
    Maxicharger Dc Hipower Firmware
    Vendor
    Autel
    Product
    Maxicharger Dh480
    Vendor
    Autel
    Product
    Maxicharger Dh480 Firmware
    Vendor
    Autel
    Product
    Maxicharger Single Charger
    Vendor
    Autel
    Product
    Maxicharger Single Charger Firmware

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-500 WebView Injection

    Related CVEs

    CVE-2025-5825 (CVSS 7.5) — Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerabi…
    CVE-2025-6678 (CVSS 7.5) — Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This …
    CVE-2025-5830 (CVSS 8.8) — Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vul…
    CVE-2025-5829 (CVSS 6.8) — Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerabi…
    CVE-2025-5827 (CVSS 8.8) — Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Executio…
    CVE-2025-5822 (CVSS 8.8) — Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerabil…
    CVE-2025-5828 (CVSS 6.8) — Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vuln…
    CVE-2025-5826 (CVSS 6.3) — Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This v…
    CVE-2025-5824 (CVSS 7.5) — Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vuln…
    CVE-2024-23959 (CVSS 8) — Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl Stack-based Buffer Overflow Remote Code Executi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High