What is the CVSS score of CVE-2025-5824?

CVE-2025-5824 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Maxicharger Ac Elite Business C50 Firmware are affected by CVE-2025-5824?

Autel MaxiCharger AC Wallbox Commercial units are vulnerable to authentication bypass attacks through Bluetooth pairing exploitation, potentially allowing unauthorized access to charging…

How to fix or mitigate CVE-2025-5824?

Within 24 hours: Inventory all Autel MaxiCharger AC Wallbox Commercial installations and isolate from critical network segments; disable Bluetooth pairing if operationally feasible. Within 7 days: Implement network segmentation to restrict charger management access to authorized personnel only and enable any available firmware security updates from Autel. Within 30 days: Establish continuous monitoring for suspicious Bluetooth connection attempts and prepare for patched firmware deployment once vendor releases a fix; consider evaluating alternative charging infrastructure vendors if business-critical.

Maxicharger Ac Elite Business C50 Firmware CVE-2025-5824

EUVD-2025-19124 HIGH

Origin Validation Error (CWE-346)

2025-06-25 zdi-disclosures@trendmicro.com

Authentication Bypass Maxicharger Ac Elite Business C50 Firmware Maxicharger Ac Pro Firmware Maxicharger Ac Ultra Firmware Maxicharger Dc Compact Mobile Firmware Maxicharger Dc Compact Pedestal Firmware Maxicharger Dc Fast Firmware Maxicharger Dc Hipower Firmware Maxicharger Dh480 Firmware Maxicharger Single Charger Firmware Autel

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-19124

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

CVE Published

Jun 25, 2025 - 18:15 nvd

HIGH 7.5

DescriptionCVE.org

Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of bluetooth pairing requests. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26353.

AnalysisAI

CVE-2025-5824 is an authentication bypass vulnerability in Autel MaxiCharger AC Wallbox Commercial that allows network-adjacent attackers to bypass authentication through insufficient origin validation in Bluetooth pairing requests. The vulnerability (formerly ZDI-CAN-26353) has a CVSS score of 7.5 with high confidentiality, integrity, and availability impact; exploitation requires prior ability to pair a malicious Bluetooth device with the target system. No KEV or active exploitation data was provided in the supplied intelligence, and patch availability status is not documented in the available information.

Technical ContextAI

The vulnerability exists in the Bluetooth pairing request handling mechanism of Autel MaxiCharger AC Wallbox Commercial. The root cause is classified under CWE-346 (Origin Validation Error), which encompasses insufficient verification that commands originate from legitimate sources before processing them. In the context of Bluetooth-enabled charging infrastructure, the wallbox fails to properly authenticate the origin of pairing requests, allowing an attacker who has already obtained proximity and pairing capability to send spoofed or maliciously crafted commands that bypass the device's authentication layer. This is particularly critical for charging infrastructure as it exposes vehicle charging control and potentially energy management systems to unauthorized manipulation. The attack surface is limited to devices that support Bluetooth connectivity and that have insufficient mutual authentication protocols during the pairing and command validation phases.

RemediationAI

Specific patch versions and availability dates were not provided in the supplied intelligence. Organizations should: (1) Contact Autel support directly to obtain patched firmware versions for MaxiCharger AC Wallbox Commercial; (2) Review Autel's official security advisory (associated with ZDI-CAN-26353) for version-specific fixes; (3) If patches are not immediately available, implement compensating controls such as disabling Bluetooth pairing on wallboxes in untrusted environments, restricting physical proximity access, or isolating charging infrastructure on segmented networks; (4) Monitor the affected systems for unauthorized pairing attempts using any available logging/alerting mechanisms. Vendor advisories and patch availability should be obtained from Autel's official security channels or CISA's CVE tracking system.