← Back

CVE-2025-5828

nvd nist
Published: Jun 25, 2025Modified: Jun 17, 2026

JSON object

Loading...
6.8
Vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 0.9 / Impact: 5.9
Source: zdi-disclosures@trendmicro.com (Secondary)

Description

Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of USB frame packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26328.

Affected (18)

Autel
9 products
Maxicharger Ac Elite Business C50 Firmware
Maxicharger Ac Pro Firmware
Maxicharger Ac Ultra Firmware
Maxicharger Dc Compact Mobile Firmware
Maxicharger Dc Compact Pedestal Firmware
Maxicharger Dc Fast Firmware
Maxicharger Dc Hipower Firmware
Maxicharger Dh480 Firmware
Maxicharger Single Charger Firmware
Configuration A
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Ac Elite Business C50 Firmware
Before 1.39.51
Maxicharger Ac Elite Business C50 Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Ac Elite Business C50
All versions
Configuration B
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Ac Pro Firmware
Before 1.39.51
Maxicharger Ac Pro Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Ac Pro
All versions
Configuration C
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Ac Ultra Firmware
Before 1.39.51
Maxicharger Ac Ultra Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Ac Ultra
All versions
Configuration D
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dc Compact Mobile Firmware
Before 1.39.51
Maxicharger Dc Compact Mobile Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dc Compact Mobile
All versions
Configuration E
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dc Compact Pedestal Firmware
Before 1.39.51
Maxicharger Dc Compact Pedestal Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dc Compact Pedestal
All versions
Configuration F
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dc Fast Firmware
Before 1.39.51
Maxicharger Dc Fast Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dc Fast
All versions
Configuration G
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dc Hipower Firmware
Before 1.39.51
Maxicharger Dc Hipower Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dc Hipower
All versions
Configuration H
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dh480 Firmware
Before 1.39.51
Maxicharger Dh480 Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dh480
All versions
Configuration I
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Single Charger Firmware
Before 1.39.51
Maxicharger Single Charger Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Single Charger
All versions

Related CWEs

CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (1)

Source: zdi-disclosures@trendmicro.com
Third Party Advisory

Timeline

No history available yet.