CVE-2025-5826

MEDIUM

Published Jun 25, 2025 Modified Sep 10, 2025 CWE-115

Description

Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368.

CVSS v3.1 Score

6.3

MEDIUM

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness Type (CWE)

CWE-115 CWE-115

Affected Products

Vendor	Product	Versions
autel	maxicharger_ac_elite_business_c50_firmware	< 1.39.51
autel	maxicharger_ac_elite_business_c50_firmware	< 1.56.51
autel	maxicharger_ac_elite_business_c50	All
autel	maxicharger_ac_pro_firmware	< 1.39.51
autel	maxicharger_ac_pro_firmware	< 1.56.51
autel	maxicharger_ac_pro	All
autel	maxicharger_ac_ultra_firmware	< 1.39.51
autel	maxicharger_ac_ultra_firmware	< 1.56.51
autel	maxicharger_ac_ultra	All
autel	maxicharger_dc_compact_mobile_firmware	< 1.39.51
autel	maxicharger_dc_compact_mobile_firmware	< 1.56.51
autel	maxicharger_dc_compact_mobile	All
autel	maxicharger_dc_compact_pedestal_firmware	< 1.39.51
autel	maxicharger_dc_compact_pedestal_firmware	< 1.56.51
autel	maxicharger_dc_compact_pedestal	All
autel	maxicharger_dc_fast_firmware	< 1.39.51
autel	maxicharger_dc_fast_firmware	< 1.56.51
autel	maxicharger_dc_fast	All
autel	maxicharger_dc_hipower_firmware	< 1.39.51
autel	maxicharger_dc_hipower_firmware	< 1.56.51
autel	maxicharger_dc_hipower	All
autel	maxicharger_dh480_firmware	< 1.39.51
autel	maxicharger_dh480_firmware	< 1.56.51
autel	maxicharger_dh480	All
autel	maxicharger_single_charger_firmware	< 1.39.51
autel	maxicharger_single_charger_firmware	< 1.56.51
autel	maxicharger_single_charger	All

References

Other References

https://www.zerodayinitiative.com/advisories/ZDI-25-345/

Frequently Asked Questions

What is CVE-2025-5826? +

How severe is CVE-2025-5826? +

CVE-2025-5826 has a CVSS v3.1 score of 6.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-5826? +

CVE-2025-5826 affects products from autel, specifically: maxicharger_ac_elite_business_c50, maxicharger_ac_elite_business_c50_firmware, maxicharger_ac_pro, maxicharger_ac_pro_firmware, maxicharger_ac_ultra, maxicharger_ac_ultra_firmware, maxicharger_dc_compact_mobile, maxicharger_dc_compact_mobile_firmware, maxicharger_dc_compact_pedestal, maxicharger_dc_compact_pedestal_firmware, maxicharger_dc_fast, maxicharger_dc_fast_firmware, maxicharger_dc_hipower, maxicharger_dc_hipower_firmware, maxicharger_dh480, maxicharger_dh480_firmware, maxicharger_single_charger, maxicharger_single_charger_firmware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-5826? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-5747 8.0

WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers …

CVE-2024-11169 7.5

An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module …

CVE-2025-32908 7.5

A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, …

CVE-2023-32260 6.5

Misinterpretation of Input vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX), and OpenText™ Hybrid Cloud …

CVE-2025-68113 6.5

ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload …

CVE-2025-25069 6.5

A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP …