nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-5826 CVE-2025-5826
MEDIUM
Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability
Record summary
CVE-2025-5826 has a selected CVSS score of 6.3 (medium).
Description
Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 26, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Autel MaxiCharger AC Wallbox CommercialBrowse Autel / Autel MaxiCharger AC Wallbox CommercialDefault status: unknown | CVE List | 1.36.00 | affected |
References
2ZDI-25-345x_research advisory
https://www.zerodayinitiative.com/advisories/ZDI-25-345