CVE Feed

    Dashboard / CVE / CVE-2025-6678

    CVE-2025-6678

    Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Pile API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26352.

    Published:Jun 25, 2025
    Last Modified:Sep 10, 2025
    EPS:Jun 25, 2025
    EPSS Score:0.00746
    CVSS Score:7.5

    Affected Products

    Vendor
    Autel
    Product
    Maxicharger Ac Elite Business C50
    Vendor
    Autel
    Product
    Maxicharger Ac Elite Business C50 Firmware
    Vendor
    Autel
    Product
    Maxicharger Ac Pro
    Vendor
    Autel
    Product
    Maxicharger Ac Pro Firmware
    Vendor
    Autel
    Product
    Maxicharger Ac Ultra
    Vendor
    Autel
    Product
    Maxicharger Ac Ultra Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Mobile
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Mobile Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Pedestal
    Vendor
    Autel
    Product
    Maxicharger Dc Compact Pedestal Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Fast
    Vendor
    Autel
    Product
    Maxicharger Dc Fast Firmware
    Vendor
    Autel
    Product
    Maxicharger Dc Hipower
    Vendor
    Autel
    Product
    Maxicharger Dc Hipower Firmware
    Vendor
    Autel
    Product
    Maxicharger Dh480
    Vendor
    Autel
    Product
    Maxicharger Dh480 Firmware
    Vendor
    Autel
    Product
    Maxicharger Single Charger
    Vendor
    Autel
    Product
    Maxicharger Single Charger Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-5825 (CVSS 7.5) — Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerabi…
    CVE-2025-5830 (CVSS 8.8) — Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vul…
    CVE-2025-5829 (CVSS 6.8) — Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerabi…
    CVE-2025-5823 (CVSS 6.5) — Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerab…
    CVE-2025-5827 (CVSS 8.8) — Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Executio…
    CVE-2025-5822 (CVSS 8.8) — Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerabil…
    CVE-2025-5828 (CVSS 6.8) — Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vuln…
    CVE-2025-5826 (CVSS 6.3) — Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This v…
    CVE-2025-5824 (CVSS 7.5) — Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vuln…
    CVE-2024-23959 (CVSS 8) — Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl Stack-based Buffer Overflow Remote Code Executi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High