Maxicharger Ac Elite Business C50 Firmware CVE-2025-5827

CVE-2025-5827 represents a CRITICAL real-world risk despite being network-adjacent rather than network-accessible. CVSS 8.8 (High) with AV:A (Adjacent Network) reflects the attack vector limitation, but this is offset by AC:L (Low Complexity), PR:N (No Privileges Required), UI:N (No User Interaction), and S:U/C:H/I:H/A:H (Confidentiality, Integrity, and Availability all High). The vulnerability is ZDI-tracked (ZDI-CAN-26369), indicating credible disclosure through a coordinated vulnerability research program. The lack of authentication requirement is significant—attackers with network adjacency (same local network, BLE range ~10-100 meters depending on implementation) can trigger RCE without credentials. The attack complexity being low indicates straightforward exploitation. Real-world risk is HIGH because: (1) EV charging infrastructure is critical physical infrastructure, (2) commercial installations may have multiple wallboxes on shared networks, (3) network-adjacent access is easily achievable in parking facilities, office buildings, or public charging stations, (4) absence of authentication enables opportunistic attacks. This is NOT a theoretical high-CVSS issue—it represents practical compromisable systems requiring only proximity and standard BLE tools.

An attacker within BLE range of a commercial EV charging installation (e.g., parking garage, office building, fleet facility) identifies Autel MaxiCharger AC Wallbox Commercial devices via standard BLE scanning tools (e.g., nRF Connect, Bluetooth scanner apps). The attacker crafts a malicious BLE message with an oversized payload field targeting the ble_process_esp32_msg function. The message is sent over BLE without authentication, triggering the buffer overflow on the ESP32 device. Due to lack of bounds validation, the payload overwrites the stack and control flow data (return pointer). The attacker gains code execution in the device's context, allowing them to: intercept charging transactions, modify charging parameters, disable safety systems, extract firmware/private keys, or pivot to facility networks if the charger is networked. No user interaction is required—the device processes the malicious BLE message automatically. Proof-of-concept tools for ESP32 buffer overflows are widely available in the security community, and the straightforward nature of the vulnerability (CWE-121 is fundamental) means reliable exploits are likely already in circulation post-disclosure.