Multiple vulnerabilities in Autel Energy MaxiCharger AC Elite Business 50A

1) Incorrect authorization

EUVDB-ID: #VU111123

Risk: Medium

CVSSv4.0: 5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-5822

CWE-ID: CWE-863 - Incorrect Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to incorrect authorization within the implementation of the Autel Technician API. A remote user can gain elevated privileges on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MaxiCharger AC Elite Business 50A: before US 1.39.51

CPE2.3

• cpe:2.3:h:autel_energy:maxicharger_ac_elite_business_50a:*:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-25-340/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Heap-based buffer overflow

EUVDB-ID: #VU111132

Risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-5830

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the handling of DLB_SlaveRegister messages. A remote attacker on the local network can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MaxiCharger AC Elite Business 50A: before US 1.39.51

CPE2.3

• cpe:2.3:h:autel_energy:maxicharger_ac_elite_business_50a:*:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-25-349/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Stack-based buffer overflow

EUVDB-ID: #VU111131

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-5829

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the handling of JSON messages. An attacker with physical access can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MaxiCharger AC Elite Business 50A: before US 1.39.51

CPE2.3

• cpe:2.3:h:autel_energy:maxicharger_ac_elite_business_50a:*:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-25-348/

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU111130

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-5828

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the handling of USB frame packets. An attacker with physical access can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MaxiCharger AC Elite Business 50A: before US 1.39.51

CPE2.3

• cpe:2.3:h:autel_energy:maxicharger_ac_elite_business_50a:*:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-25-347/

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Stack-based buffer overflow

EUVDB-ID: #VU111129

Risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-5827

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the ble_process_esp32_msg function. A remote unauthenticated attacker on the local network can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MaxiCharger AC Elite Business 50A: before US 1.39.51

CPE2.3

• cpe:2.3:h:autel_energy:maxicharger_ac_elite_business_50a:*:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-25-346/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU111128

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-5826

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input within the ble_process_esp32_msg function. A remote attacker can pass specially crafted input to the application and execute AT commands in the context of the target device.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MaxiCharger AC Elite Business 50A: before US 1.39.51

CPE2.3

• cpe:2.3:h:autel_energy:maxicharger_ac_elite_business_50a:*:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-25-345/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Security features bypass

EUVDB-ID: #VU111127

Risk: High

CVSSv4.0: 5.2 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-5825

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the lack of proper validation of a firmware image before using it to perform an upgrade. A remote attacker on the local network can bypass implemented security restrictions and execute arbitrary code on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MaxiCharger AC Elite Business 50A: before US 1.39.51

CPE2.3

• cpe:2.3:h:autel_energy:maxicharger_ac_elite_business_50a:*:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-25-344/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Origin validation error

EUVDB-ID: #VU111126

Risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-5824

CWE-ID: CWE-346 - Origin Validation Error

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of the origin of commands within the handling of bluetooth pairing requests. A remote attacker on the local network can bypass authentication on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MaxiCharger AC Elite Business 50A: before US 1.39.51

CPE2.3

• cpe:2.3:h:autel_energy:maxicharger_ac_elite_business_50a:*:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-25-343/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper Authentication

EUVDB-ID: #VU111125

Risk: High

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: N/A

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when processing authentication requests within the Pile API. A remote attacker can bypass authentication process and gain unauthorized access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MaxiCharger AC Elite Business 50A: before US 1.39.51

CPE2.3

• cpe:2.3:h:autel_energy:maxicharger_ac_elite_business_50a:*:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-25-342/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Exposed dangerous method or function

EUVDB-ID: #VU111124

Risk: Low

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-5823

CWE-ID: CWE-749 - Exposed Dangerous Method or Function

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to the exposure of a dangerous function in within the implementation of the Autel Technician API. A remote administrator can disclose credentials on the system. 

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MaxiCharger AC Elite Business 50A: before US 1.39.51

CPE2.3

• cpe:2.3:h:autel_energy:maxicharger_ac_elite_business_50a:*:*:*:*:*:*:*:*

External links

https://www.zerodayinitiative.com/advisories/ZDI-25-341/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.