Maxicharger Ac Elite Business C50 Firmware CVE-2025-6678

This vulnerability presents significant real-world risk despite lacking additional context on EPSS or KEV status. The CVSS 7.5 High rating is justified and not inflated: AV:N (network-accessible from remote), AC:L (no special conditions required), PR:N (no privileges needed), UI:N (no user interaction), and C:H (high confidentiality impact via credential disclosure). The attack surface is broad—any Autel MaxiCharger AC Wallbox Commercial unit connected to a network is potentially vulnerable. The absence of authentication is the critical factor: this is not a complex privilege escalation or chaining scenario, but straightforward unauthenticated API access. If KEV status indicates active exploitation or a POC exists, priority is critical. Even without those signals, the trivial exploitation (no tools, no complexity, immediate credential access) combined with networked infrastructure deployment (difficult to isolate completely) makes this a high-priority remediation candidate. The credential disclosure opens secondary attack vectors including account takeover, API manipulation, and potential control of charging sessions or billing systems.

An attacker on the same network segment as an Autel MaxiCharger AC Wallbox Commercial installation (or directly internet-accessible if not behind a firewall) sends an unauthenticated HTTP GET request to a Pile API endpoint such as /api/credentials, /api/config, or /api/user. Due to the missing authentication check, the API responds with sensitive information including API keys, user credentials, or station configuration data. The attacker extracts credentials and uses them to: (a) access the charging station management portal to disable charging, manipulate billing, or lock customers out; (b) pivot to backend systems if the same credentials are reused; or (c) establish persistence for future attacks. No POC complexity is required—a simple curl request or browser navigation to the endpoint is sufficient. Exploitation is immediate and requires no interaction with legitimate users, making this a high-velocity threat if the charging infrastructure is exposed to untrusted networks.