CVE Feed

    Dashboard / CVE / CVE-2025-5826

    CVE-2025-5826

    Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368.

    Published:Jun 25, 2025
    Last Modified:Sep 10, 2025
    EPS:Jun 25, 2025
    EPSS Score:0.00102
    CVSS Score:6.3

    Affected Products

    Vendor
    Autel
    Product
    Maxicharger Ac Elite Business C50
    Vendor
    Autel
    Product
    Maxicharger Ac Elite Business C50 Firmware
    Vendor
    Autel
    Product
    Maxicharger Ac Pro
    Vendor
    Autel
    Product
    Maxicharger Ac Pro Firmware
    Vendor
    Autel
    Product
    Maxicharger Ac Ultra
    Vendor
    Autel
    Product
    Maxicharger Ac Ultra Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Mobile
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Mobile Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Pedestal
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Pedestal Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Fast
    Vendor
    Autel
    Product
    Maxicharger Dc Fast Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Hipower
    Vendor
    Autel
    Product
    Maxicharger Dc Hipower Firmware
    Vendor
    Autel
    Product
    Maxicharger Dh480
    Vendor
    Autel
    Product
    Maxicharger Dh480 Firmware
    Vendor
    Autel
    Product
    Maxicharger Single Charger
    Vendor
    Autel
    Product
    Maxicharger Single Charger Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-115 Misinterpretation of Input

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-5825 (CVSS 7.5) — Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerabi…
    CVE-2025-6678 (CVSS 7.5) — Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This …
    CVE-2025-5830 (CVSS 8.8) — Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vul…
    CVE-2025-5829 (CVSS 6.8) — Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerabi…
    CVE-2025-5823 (CVSS 6.5) — Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerab…
    CVE-2025-5827 (CVSS 8.8) — Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Executio…
    CVE-2025-5822 (CVSS 8.8) — Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerabil…
    CVE-2025-5828 (CVSS 6.8) — Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vuln…
    CVE-2025-5824 (CVSS 7.5) — Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vuln…
    CVE-2024-23959 (CVSS 8) — Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl Stack-based Buffer Overflow Remote Code Executi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High