CVE-2025-6678

moderate-risk

Published 2025-06-25

Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Pile API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26352.

Do I need to act?

0.50% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (18)

Maxicharger Dc Fast Firmware

Maxicharger Dc Hipower Firmware

Maxicharger Dh480 Firmware

Maxicharger Single Charger Firmware

Maxicharger Ac Elite Business C50 Firmware

Maxicharger Ac Pro Firmware

Maxicharger Ac Ultra Firmware

Maxicharger Dc Compact Mobile Firmware

Maxicharger Dc Compact Pedestal Firmware

Maxicharger Dc Fast Firmware

Affected Vendors

Autel

References (1)

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-25-342/

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 2/34 · Minimal

Exposure 19/34 · Moderate