6.5

CVE-2025-5823

Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Autel ≫ Maxicharger Ac Pro Firmware Version < 1.39.51
   Autel ≫ Maxicharger Ac Pro Version-
Autel ≫ Maxicharger Ac Pro Firmware Version < 1.56.51
   Autel ≫ Maxicharger Ac Pro Version-
Autel ≫ Maxicharger Ac Ultra Firmware Version < 1.39.51
   Autel ≫ Maxicharger Ac Ultra Version-
Autel ≫ Maxicharger Ac Ultra Firmware Version < 1.56.51
   Autel ≫ Maxicharger Ac Ultra Version-
Autel ≫ Maxicharger Dc Fast Firmware Version < 1.39.51
   Autel ≫ Maxicharger Dc Fast Version-
Autel ≫ Maxicharger Dc Fast Firmware Version < 1.56.51
   Autel ≫ Maxicharger Dc Fast Version-
Autel ≫ Maxicharger Dc Hipower Firmware Version < 1.39.51
   Autel ≫ Maxicharger Dc Hipower Version-
Autel ≫ Maxicharger Dc Hipower Firmware Version < 1.56.51
   Autel ≫ Maxicharger Dc Hipower Version-
Autel ≫ Maxicharger Dh480 Firmware Version < 1.39.51
   Autel ≫ Maxicharger Dh480 Version-
Autel ≫ Maxicharger Dh480 Firmware Version < 1.56.51
   Autel ≫ Maxicharger Dh480 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.14% 0.347
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
zdi-disclosures@trendmicro.com 4.9 1.2 3.6
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CWE-749 Exposed Dangerous Method or Function

The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.