CVE-2025-5822

moderate-risk

Published 2025-06-25

Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability. The specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325.

Do I need to act?

0.06% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (18)

Maxicharger Ac Elite Business C50 Firmware

Maxicharger Ac Pro Firmware

Maxicharger Ac Ultra Firmware

Maxicharger Dc Compact Mobile Firmware

Maxicharger Dc Compact Pedestal Firmware

Maxicharger Dc Fast Firmware

Maxicharger Dc Hipower Firmware

Maxicharger Dh480 Firmware

Maxicharger Single Charger Firmware

Affected Vendors

Autel

References (1)

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-25-340/

/ 100

moderate-risk

Severity 30/34 · Critical

Exploitability 0/34 · Minimal

Exposure 19/34 · Moderate