← Back

CVE-2025-5822

nvd nist
Published: Jun 25, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability. The specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325.

Affected (18)

Autel
9 products
Maxicharger Ac Elite Business C50 Firmware
Maxicharger Ac Pro Firmware
Maxicharger Ac Ultra Firmware
Maxicharger Dc Compact Mobile Firmware
Maxicharger Dc Compact Pedestal Firmware
Maxicharger Dc Fast Firmware
Maxicharger Dc Hipower Firmware
Maxicharger Dh480 Firmware
Maxicharger Single Charger Firmware
Configuration A
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Ac Elite Business C50 Firmware
Before 1.39.51
Maxicharger Ac Elite Business C50 Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Ac Elite Business C50
All versions
Configuration B
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Ac Pro Firmware
Before 1.39.51
Maxicharger Ac Pro Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Ac Pro
All versions
Configuration C
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Ac Ultra Firmware
Before 1.39.51
Maxicharger Ac Ultra Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Ac Ultra
All versions
Configuration D
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dc Compact Mobile Firmware
Before 1.39.51
Maxicharger Dc Compact Mobile Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dc Compact Mobile
All versions
Configuration E
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dc Compact Pedestal Firmware
Before 1.39.51
Maxicharger Dc Compact Pedestal Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dc Compact Pedestal
All versions
Configuration F
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dc Fast Firmware
Before 1.39.51
Maxicharger Dc Fast Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dc Fast
All versions
Configuration G
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dc Hipower Firmware
Before 1.39.51
Maxicharger Dc Hipower Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dc Hipower
All versions
Configuration H
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dh480 Firmware
Before 1.39.51
Maxicharger Dh480 Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dh480
All versions
Configuration I
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Single Charger Firmware
Before 1.39.51
Maxicharger Single Charger Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Single Charger
All versions

Related CWEs

CWE-863
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (1)

Source: zdi-disclosures@trendmicro.com
Third Party Advisory

Timeline

No history available yet.