nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-6678 CVE-2025-6678
HIGH
Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability
Record summary
CVE-2025-6678 has a selected CVSS score of 7.5 (high).
Description
Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Pile API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26352.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 25, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Autel MaxiCharger AC Wallbox CommercialBrowse Autel / Autel MaxiCharger AC Wallbox CommercialDefault status: unknown | CVE List | 1.36.00 | affected |
References
2ZDI-25-342x_research advisory
https://www.zerodayinitiative.com/advisories/ZDI-25-342