CVE-2025-6678

CVE-2025-6678 affects Autel MaxiCharger AC Wallbox Commercial. The vulnerability is in the Pile API where an authentication check is missing, allowing remote disclosure of sensitive information (e.g., credentials) without user interaction. The issue is documented with a NVD/NIST entry and tied to...

CVE-2025-5825

CVE-2025-5825: Affects Autel MaxiCharger AC Wallbox Commercial. Root cause is insufficient validation of a firmware image during upgrade, enabling a downgrade path that can lead to remote code execution. Exploitation requires network-adjacent access and pairing of a malicious Bluetooth device, wi...

CVE-2025-5826

CVE-2025-5826 concerns Autel MaxiCharger AC Wallbox Commercial. The flaw is in the ble_process_esp32_msg function, arising from misinterpretation of input data. It allows network-adjacent attackers to inject arbitrary AT commands in the device context without authentication. Documented impact is ...

CVE-2025-5822

Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation is confirmed for CVE-2025-5822. The flaw exists in the Autel Technician API implementation and results from incorrect authorization, allowing an attacker who has obtained a low-privilege authorizat...

CVE-2025-5829

Autel MaxiCharger AC Wallbox Commercial is affected by CVE-2025-5829. The issue is a stack-based buffer overflow in JSON message handling caused by insufficient validation of user-supplied data before copying to a fixed-length buffer, enabling remote code execution. Impact: requires physical acce...

CVE-2025-5830

CVE-2025-5830 concerns Autel MaxiCharger AC Wallbox Commercial. The flaw is a heap-based buffer overflow in the DLB_SlaveRegister message handling caused by insufficient validation of the length of user-supplied data before copying to a fixed-length heap buffer. This can allow remote code executi...

CVE-2025-5823

CVE-2025-5823 affects Autel MaxiCharger AC Wallbox Commercial. The vulnerability lies in the Autel Technician API where an exposed dangerous method allows an attacker to disclose sensitive information, notably credentials/serial numbers, leading to potential further compromise. The NVD/CVE entrie...

CVE-2025-5827

CVE-2025-5827 affects Autel MaxiCharger AC Wallbox Commercial. The root cause is a stack-based buffer overflow in ble_process_esp32_msg due to inadequate validation of user-supplied data length, enabling remote code execution. The vulnerability allows network-adjacent attackers to run arbitrary c...

CVE-2025-5824

CVE-2025-5824 affects Autel MaxiCharger AC Wallbox Commercial. The flaw is an origin validation error in Bluetooth pairing handling, allowing network-adjacent attackers to bypass authentication by exploiting insufficient validation of command origins. Multiple sources (ZDI-25-343, NVD/NVD-derived...

CVE-2025-5828

The CVE-2025-5828 entry concerns Autel MaxiCharger AC Wallbox Commercial with a wLength buffer overflow in USB frame packet handling. The root cause is a lack of validation of the length of user-supplied data before copying to a fixed-length buffer, enabling arbitrary code execution in the device...