CVE-2025-5822
HIGHDescription
Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability. The specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| autel | maxicharger_ac_elite_business_c50_firmware |
| autel | maxicharger_ac_elite_business_c50_firmware |
| autel | maxicharger_ac_elite_business_c50 |
| autel | maxicharger_ac_pro_firmware |
| autel | maxicharger_ac_pro_firmware |
| autel | maxicharger_ac_pro |
| autel | maxicharger_ac_ultra_firmware |
| autel | maxicharger_ac_ultra_firmware |
| autel | maxicharger_ac_ultra |
| autel | maxicharger_dc_compact_mobile_firmware |
| autel | maxicharger_dc_compact_mobile_firmware |
| autel | maxicharger_dc_compact_mobile |
| autel | maxicharger_dc_compact_pedestal_firmware |
| autel | maxicharger_dc_compact_pedestal_firmware |
| autel | maxicharger_dc_compact_pedestal |
| autel | maxicharger_dc_fast_firmware |
| autel | maxicharger_dc_fast_firmware |
| autel | maxicharger_dc_fast |
| autel | maxicharger_dc_hipower_firmware |
| autel | maxicharger_dc_hipower_firmware |
| autel | maxicharger_dc_hipower |
| autel | maxicharger_dh480_firmware |
| autel | maxicharger_dh480_firmware |
| autel | maxicharger_dh480 |
| autel | maxicharger_single_charger_firmware |
| autel | maxicharger_single_charger_firmware |
| autel | maxicharger_single_charger |
References
Other References
Frequently Asked Questions
What is CVE-2025-5822? +
How severe is CVE-2025-5822? +
What products are affected by CVE-2025-5822? +
How do I check if I'm vulnerable to CVE-2025-5822? +
Related Vulnerabilities
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version …
Pelican is a platform for creating data federations. From versions 7.21.0 to before 7.21.5, 7.22.0 to before 7.22.3, 7.23.0 to …
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently …
An incorrect authorization vulnerability in MISP allows an organization administrator to target site administrator accounts belonging to the same organization …
Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 …
Actual is a local-first personal finance tool. The `POST /openid/config` endpoint in Actual Budget's sync-server versions <= 26.4.0 exposes the …