CVE-2025-6678

HIGH

Autel MaxiCharger AC Wallbox Commercial - Unauthenticated Information Disclosure via Pile API

Title source: llm
STIX 2.1

Description

Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Pile API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26352.

References (1)

Core 1
Core References
Third Party Advisory x_research-advisory
https://www.zerodayinitiative.com/advisories/ZDI-25-342/

Scores

CVSS v3 7.5
EPSS 0.0042
EPSS Percentile 33.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-306
Status published
Products (18)
autel/maxicharger_ac_elite_business_c50_firmware < 1.39.51
autel/maxicharger_ac_elite_business_c50_firmware < 1.56.51
autel/maxicharger_ac_pro_firmware < 1.39.51
autel/maxicharger_ac_pro_firmware < 1.56.51
autel/maxicharger_ac_ultra_firmware < 1.39.51
autel/maxicharger_ac_ultra_firmware < 1.56.51
autel/maxicharger_dc_compact_mobile_firmware < 1.39.51
autel/maxicharger_dc_compact_mobile_firmware < 1.56.51
autel/maxicharger_dc_compact_pedestal_firmware < 1.39.51
autel/maxicharger_dc_compact_pedestal_firmware < 1.56.51
... and 8 more
Published Jun 25, 2025
Tracked Since Feb 18, 2026