CVE Feed

    Dashboard / CVE / CVE-2025-5828

    CVE-2025-5828

    Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of USB frame packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26328.

    Published:Jun 25, 2025
    Last Modified:Sep 10, 2025
    EPS:Jun 25, 2025
    EPSS Score:0.00131
    CVSS Score:6.8

    Affected Products

    Vendor
    Autel
    Product
    Maxicharger Ac Elite Business C50
    Vendor
    Autel
    Product
    Maxicharger Ac Elite Business C50 Firmware
    Vendor
    Autel
    Product
    Maxicharger Ac Pro
    Vendor
    Autel
    Product
    Maxicharger Ac Pro Firmware
    Vendor
    Autel
    Product
    Maxicharger Ac Ultra
    Vendor
    Autel
    Product
    Maxicharger Ac Ultra Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Mobile
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Mobile Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Pedestal
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Pedestal Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Fast
    Vendor
    Autel
    Product
    Maxicharger Dc Fast Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Hipower
    Vendor
    Autel
    Product
    Maxicharger Dc Hipower Firmware
    Vendor
    Autel
    Product
    Maxicharger Dh480
    Vendor
    Autel
    Product
    Maxicharger Dh480 Firmware
    Vendor
    Autel
    Product
    Maxicharger Single Charger
    Vendor
    Autel
    Product
    Maxicharger Single Charger Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-5825 (CVSS 7.5) — Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerabi…
    CVE-2025-6678 (CVSS 7.5) — Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This …
    CVE-2025-5830 (CVSS 8.8) — Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vul…
    CVE-2025-5829 (CVSS 6.8) — Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerabi…
    CVE-2025-5823 (CVSS 6.5) — Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerab…
    CVE-2025-5827 (CVSS 8.8) — Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Executio…
    CVE-2025-5822 (CVSS 8.8) — Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerabil…
    CVE-2025-5826 (CVSS 6.3) — Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This v…
    CVE-2025-5824 (CVSS 7.5) — Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vuln…
    CVE-2024-23959 (CVSS 8) — Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl Stack-based Buffer Overflow Remote Code Executi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High