Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability.
The specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325.
References
| Link | Resource |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-25-340/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
Configuration 7 (hide)
| AND |
|
Configuration 8 (hide)
| AND |
|
Configuration 9 (hide)
| AND |
|
History
10 Sep 2025, 14:46
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware:*:*:*:*:*:*:*:american_standard cpe:2.3:h:autel:maxicharger_dc_hipower:-:*:*:*:*:*:*:* cpe:2.3:h:autel:maxicharger_dh480:-:*:*:*:*:*:*:* cpe:2.3:o:autel:maxicharger_single_charger_firmware:*:*:*:*:*:*:*:american_standard cpe:2.3:h:autel:maxicharger_ac_pro:-:*:*:*:*:*:*:* cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware:*:*:*:*:*:*:*:european_standard cpe:2.3:o:autel:maxicharger_dc_fast_firmware:*:*:*:*:*:*:*:american_standard cpe:2.3:o:autel:maxicharger_single_charger_firmware:*:*:*:*:*:*:*:european_standard cpe:2.3:o:autel:maxicharger_ac_ultra_firmware:*:*:*:*:*:*:*:american_standard cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware:*:*:*:*:*:*:*:european_standard cpe:2.3:o:autel:maxicharger_dh480_firmware:*:*:*:*:*:*:*:american_standard cpe:2.3:h:autel:maxicharger_ac_ultra:-:*:*:*:*:*:*:* cpe:2.3:o:autel:maxicharger_ac_ultra_firmware:*:*:*:*:*:*:*:european_standard cpe:2.3:h:autel:maxicharger_ac_elite_business_c50:-:*:*:*:*:*:*:* cpe:2.3:o:autel:maxicharger_dh480_firmware:*:*:*:*:*:*:*:european_standard cpe:2.3:h:autel:maxicharger_dc_compact_pedestal:-:*:*:*:*:*:*:* cpe:2.3:o:autel:maxicharger_dc_hipower_firmware:*:*:*:*:*:*:*:european_standard cpe:2.3:h:autel:maxicharger_single_charger:-:*:*:*:*:*:*:* cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware:*:*:*:*:*:*:*:european_standard cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware:*:*:*:*:*:*:*:american_standard cpe:2.3:h:autel:maxicharger_dc_fast:-:*:*:*:*:*:*:* cpe:2.3:o:autel:maxicharger_dc_fast_firmware:*:*:*:*:*:*:*:european_standard cpe:2.3:o:autel:maxicharger_ac_pro_firmware:*:*:*:*:*:*:*:american_standard cpe:2.3:h:autel:maxicharger_dc_compact_mobile:-:*:*:*:*:*:*:* cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware:*:*:*:*:*:*:*:american_standard cpe:2.3:o:autel:maxicharger_ac_pro_firmware:*:*:*:*:*:*:*:european_standard cpe:2.3:o:autel:maxicharger_dc_hipower_firmware:*:*:*:*:*:*:*:american_standard |
|
| References | () https://www.zerodayinitiative.com/advisories/ZDI-25-340/ - Third Party Advisory | |
| First Time |
Autel
Autel maxicharger Ac Pro Firmware Autel maxicharger Dc Compact Mobile Firmware Autel maxicharger Dc Fast Firmware Autel maxicharger Dc Hipower Firmware Autel maxicharger Ac Elite Business C50 Autel maxicharger Dh480 Firmware Autel maxicharger Dc Compact Pedestal Autel maxicharger Single Charger Firmware Autel maxicharger Ac Ultra Firmware Autel maxicharger Dc Fast Autel maxicharger Dc Compact Mobile Autel maxicharger Dh480 Autel maxicharger Ac Pro Autel maxicharger Dc Compact Pedestal Firmware Autel maxicharger Ac Elite Business C50 Firmware Autel maxicharger Single Charger Autel maxicharger Ac Ultra Autel maxicharger Dc Hipower |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
26 Jun 2025, 18:57
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-25 18:15
Updated : 2025-09-10 14:46
NVD link : CVE-2025-5822
Mitre link : CVE-2025-5822
CVE.ORG link : CVE-2025-5822
JSON object : View
Products Affected
autel
- maxicharger_ac_pro_firmware
- maxicharger_ac_ultra
- maxicharger_ac_elite_business_c50_firmware
- maxicharger_dc_compact_mobile
- maxicharger_ac_elite_business_c50
- maxicharger_dc_fast
- maxicharger_dc_compact_pedestal
- maxicharger_dc_hipower_firmware
- maxicharger_dc_hipower
- maxicharger_dh480
- maxicharger_dh480_firmware
- maxicharger_single_charger_firmware
- maxicharger_single_charger
- maxicharger_ac_pro
- maxicharger_ac_ultra_firmware
- maxicharger_dc_fast_firmware
- maxicharger_dc_compact_mobile_firmware
- maxicharger_dc_compact_pedestal_firmware
CWE
CWE-863
Incorrect Authorization