← Back

CVE-2025-6678

nvd nist
Published: Jun 25, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: zdi-disclosures@trendmicro.com (Secondary)

Description

Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Pile API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26352.

Affected (18)

Autel
9 products
Maxicharger Ac Elite Business C50 Firmware
Maxicharger Ac Pro Firmware
Maxicharger Ac Ultra Firmware
Maxicharger Dc Compact Mobile Firmware
Maxicharger Dc Compact Pedestal Firmware
Maxicharger Dc Fast Firmware
Maxicharger Dc Hipower Firmware
Maxicharger Dh480 Firmware
Maxicharger Single Charger Firmware
Configuration A
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Ac Elite Business C50 Firmware
Before 1.39.51
Maxicharger Ac Elite Business C50 Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Ac Elite Business C50
All versions
Configuration B
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Ac Pro Firmware
Before 1.39.51
Maxicharger Ac Pro Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Ac Pro
All versions
Configuration C
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Ac Ultra Firmware
Before 1.39.51
Maxicharger Ac Ultra Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Ac Ultra
All versions
Configuration D
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dc Compact Mobile Firmware
Before 1.39.51
Maxicharger Dc Compact Mobile Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dc Compact Mobile
All versions
Configuration E
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dc Compact Pedestal Firmware
Before 1.39.51
Maxicharger Dc Compact Pedestal Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dc Compact Pedestal
All versions
Configuration F
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dc Fast Firmware
Before 1.39.51
Maxicharger Dc Fast Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dc Fast
All versions
Configuration G
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dc Hipower Firmware
Before 1.39.51
Maxicharger Dc Hipower Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dc Hipower
All versions
Configuration H
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Dh480 Firmware
Before 1.39.51
Maxicharger Dh480 Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Dh480
All versions
Configuration I
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Autel
Maxicharger Single Charger Firmware
Before 1.39.51
Maxicharger Single Charger Firmware
Before 1.56.51
Running on/withPlatform Versions
Autel
Maxicharger Single Charger
All versions

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (1)

Source: zdi-disclosures@trendmicro.com
Third Party Advisory

Timeline

No history available yet.