PT-2025-25242 · Autel · Autel Maxicharger Ac Wallbox

Ina Kheirkhah + 1 · Publicado 2025-06-11 · Atualizado 2025-06-25 · CVE-2025-5822

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Autel MaxiCharger AC Wallbox (affected versions not specified)

Description The issue concerns an Incorrect Authorization Privilege Escalation Vulnerability in the Commercial Technician API of the Autel MaxiCharger AC Wallbox. This was discovered by Sina Kheirkhah of Summoning Team during Pwn2Own.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2025-5822

ZDI-25-340

Produtos afetados

Autel Maxicharger Ac Wallbox

Referências · 7

• https://zerodayinitiative.com/advisories/ZDI-25-340 · Nota de Segurança
• https://t.me/cvenotify/126671 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1937939401998278872 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-5822 · Nota de Segurança
• https://twitter.com/TheZDIBugs/status/1932860322999685123 · Publicação no Twitter
• https://t.me/cvetracker/27030 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-5822 · Aviso do Fabricante