CVE-2025-5822 Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability
Remote attackers with low-privileged tokens can escalate privileges on Autel MaxiCharger AC Wallbox Commercial units due to incorrect authorization in the Technician API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-5822?
CVE-2025-5822 is a high-severity vulnerability in Autel MaxiCharger AC Wallbox Commercial, published on 25 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability.
The specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325.
Weakness: CWE-863
Which versions are affected by CVE-2025-5822?
It affects 9 products.
Products include Autel Maxicharger Ac Elite Business C50 Firmware, Autel Maxicharger Ac Pro Firmware, Autel Maxicharger Ac Ultra Firmware, Autel Maxicharger Dc Compact Mobile Firmware, Autel Maxicharger Dc Compact Pedestal Firmware, Autel Maxicharger Dc Fast Firmware and 3 more.
How do I fix CVE-2025-5822?
No fix has been published for CVE-2025-5822 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-5822 being exploited?
There is no known exploitation of CVE-2025-5822 in the wild and no public exploit code.
Other vulnerabilities in Autel MaxiCharger AC Wallbox Commercial
- CVE-2025-5827 Memory corruption in Autel MaxiCharger AC Wallbox Commercial
- CVE-2025-5830 Memory corruption in Autel MaxiCharger AC Wallbox Commercial
- CVE-2024-23957 Memory corruption in MaxiCharger AC Elite Business C50
- CVE-2024-7795 Memory corruption in MaxiCharger AC Elite Business C50
- CVE-2024-23959 Memory corruption in MaxiCharger AC Elite Business C50
Sources
Also known as GHSA-68xm-7jcv-ph77.