CVE-2025-5824 Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability
Network-adjacent attackers can bypass authentication on Autel MaxiCharger AC Wallbox Commercial by pairing a malicious Bluetooth device due to insufficient origin validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-5824?
CVE-2025-5824 is a medium-severity authentication bypass vulnerability in Autel MaxiCharger AC Wallbox Commercial, published on 25 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of bluetooth pairing requests. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26353.
Weakness: CWE-346
Which versions are affected by CVE-2025-5824?
It affects 9 products.
Products include Autel Maxicharger Ac Elite Business C50 Firmware, Autel Maxicharger Ac Pro Firmware, Autel Maxicharger Ac Ultra Firmware, Autel Maxicharger Dc Compact Mobile Firmware, Autel Maxicharger Dc Compact Pedestal Firmware, Autel Maxicharger Dc Fast Firmware and 3 more.
How do I fix CVE-2025-5824?
No fix has been published for CVE-2025-5824 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-5824 being exploited?
There is no known exploitation of CVE-2025-5824 in the wild and no public exploit code.
Other vulnerabilities in Autel MaxiCharger AC Wallbox Commercial
- CVE-2025-5827 Memory corruption in Autel MaxiCharger AC Wallbox Commercial
- CVE-2025-5830 Memory corruption in Autel MaxiCharger AC Wallbox Commercial
- CVE-2024-23957 Memory corruption in MaxiCharger AC Elite Business C50
- CVE-2024-7795 Memory corruption in MaxiCharger AC Elite Business C50
- CVE-2024-23959 Memory corruption in MaxiCharger AC Elite Business C50
Sources
Also known as GHSA-vjqh-vxpx-8294.