7.5

CVE-2025-6678

Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability

Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the Pile API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26352.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Autel ≫ Maxicharger Ac Pro Firmware Version < 1.39.51
   Autel ≫ Maxicharger Ac Pro Version -
Autel ≫ Maxicharger Ac Pro Firmware Version < 1.56.51
   Autel ≫ Maxicharger Ac Pro Version -
Autel ≫ Maxicharger Ac Ultra Firmware Version < 1.39.51
   Autel ≫ Maxicharger Ac Ultra Version -
Autel ≫ Maxicharger Ac Ultra Firmware Version < 1.56.51
   Autel ≫ Maxicharger Ac Ultra Version -
Autel ≫ Maxicharger Dc Fast Firmware Version < 1.39.51
   Autel ≫ Maxicharger Dc Fast Version -
Autel ≫ Maxicharger Dc Fast Firmware Version < 1.56.51
   Autel ≫ Maxicharger Dc Fast Version -
Autel ≫ Maxicharger Dc Hipower Firmware Version < 1.39.51
   Autel ≫ Maxicharger Dc Hipower Version -
Autel ≫ Maxicharger Dc Hipower Firmware Version < 1.56.51
   Autel ≫ Maxicharger Dc Hipower Version -
Autel ≫ Maxicharger Dh480 Firmware Version < 1.39.51
   Autel ≫ Maxicharger Dh480 Version -
Autel ≫ Maxicharger Dh480 Firmware Version < 1.56.51
   Autel ≫ Maxicharger Dh480 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.42% 0.337
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Trend Micro 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://www.zerodayinitiative.com/advisories/ZDI-25-342/
Third Party Advisory