Maxicharger Ac Elite Business C50 Firmware CVE-2025-5824

The CVSS 3.1 score of 7.5 reflects high impact (C:H, I:H, A:H) but is moderated by attack complexity (AC:H) and the requirement for network adjacency (AV:A). The attack vector is adjacent network, meaning an attacker must be within Bluetooth range (typically 10-100 meters depending on Bluetooth version) and must already have obtained the ability to pair a device—this is a significant practical barrier. The high attack complexity further reduces real-world exploitation probability. While the impact is severe (full confidentiality, integrity, and availability compromise), the combination of AC:H and the prerequisite of prior device pairing establishes this as a moderate-to-high real-world priority rather than critical. Without EPSS probability data or KEV/active exploitation confirmation in the supplied intelligence, this appears to be a vulnerability with theoretical high impact but practical medium exploitation likelihood. Organizations managing Autel charging infrastructure should prioritize patching based on deployment exposure to untrusted Bluetooth environments and the sensitivity of charging management functions.

An attacker with physical proximity to a target Autel MaxiCharger AC Wallbox Commercial (within Bluetooth range, typically 10-50 meters) performs Bluetooth pairing with the device—potentially using social engineering or physical access to trigger pairing mode. Once paired, the attacker sends specially crafted commands that exploit the origin validation error, bypassing the authentication layer without providing valid credentials. With authentication bypassed, the attacker could potentially: disable charging restrictions, alter energy management settings, prevent legitimate charging operations, or extract configuration data. This scenario is feasible in multi-tenant parking facilities, fleet charging stations, or public charging infrastructure where an attacker can gain proximity and pairing capability. The requirement for prior device pairing (AC:H) means this is not a remote mass-exploitation vulnerability but rather a targeted attack against specific, accessible infrastructure.