CVE-2025-5823 Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability

Medium 4.9 Published 25 Jun 2025 Updated 26 Jun 2025

Remote attackers with authentication can exploit an exposed dangerous method in the Autel MaxiCharger AC Wallbox Commercial to disclose sensitive credentials.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-5823?

CVE-2025-5823 is a medium-severity vulnerability in Autel MaxiCharger AC Wallbox Commercial, published on 25 Jun 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351.

Weakness: CWE-749

Which versions are affected by CVE-2025-5823?

It affects 9 products.

Products include Autel Maxicharger Ac Elite Business C50 Firmware, Autel Maxicharger Ac Pro Firmware, Autel Maxicharger Ac Ultra Firmware, Autel Maxicharger Dc Compact Mobile Firmware, Autel Maxicharger Dc Compact Pedestal Firmware, Autel Maxicharger Dc Fast Firmware and 3 more.

How do I fix CVE-2025-5823?

No fix has been published for CVE-2025-5823 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-5823 being exploited?

There is no known exploitation of CVE-2025-5823 in the wild and no public exploit code.

Sources

Also known as GHSA-fh72-rhcq-wpf6.