What is the CVSS score of CVE-2025-6678?

CVE-2025-6678 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Maxicharger Ac Elite Business C50 Firmware are affected by CVE-2025-6678?

Autel MaxiCharger AC Wallbox Commercial charging stations contain an unauthenticated information disclosure vulnerability that allows attackers to remotely extract sensitive credentials without any…

How to fix or mitigate CVE-2025-6678?

Within 24 hours: Identify all Autel MaxiCharger AC Wallbox Commercial installations in your environment and isolate them from direct internet exposure if possible. Within 7 days: Implement network segmentation to restrict API access to the Pile API endpoint and deploy WAF rules to block unauthenticated requests to sensitive endpoints. Within 30 days: Rotate all credentials associated with affected charging stations, establish vendor communication for patch availability, and consider alternative charging station solutions if remediation timelines are unacceptable.

Maxicharger Ac Elite Business C50 Firmware CVE-2025-6678

EUVD-2025-28757 HIGH

Missing Authentication for Critical Function (CWE-306)

2025-06-25 zdi-disclosures@trendmicro.com

Authentication Bypass Information Disclosure Maxicharger Ac Elite Business C50 Firmware Maxicharger Ac Pro Firmware Maxicharger Ac Ultra Firmware Maxicharger Dc Compact Mobile Firmware Maxicharger Dc Compact Pedestal Firmware Maxicharger Dc Fast Firmware Maxicharger Dc Hipower Firmware Maxicharger Dh480 Firmware Maxicharger Single Charger Firmware Autel

7.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-28757

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

CVE Published

Jun 25, 2025 - 18:15 nvd

HIGH 7.5

DescriptionCVE.org

Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the Pile API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26352.

AnalysisAI

CVE-2025-6678 is an unauthenticated remote information disclosure vulnerability in Autel MaxiCharger AC Wallbox Commercial charging stations affecting the Pile API endpoint. An attacker can remotely access sensitive information including credentials without requiring authentication, enabling credential theft and potential further compromise of the charging infrastructure. The vulnerability has a CVSS 7.5 severity rating reflecting high confidentiality impact, and the lack of authentication requirements makes exploitation trivial.

Technical ContextAI

The vulnerability resides in the Pile API of Autel MaxiCharger AC Wallbox Commercial units, which are networked electric vehicle charging stations designed for commercial deployment. The root cause is classified as CWE-306 (Missing Authentication for Critical Function), indicating the Pile API endpoint fails to enforce authentication mechanisms before exposing sensitive operational data. The affected systems are networked charging appliances that communicate via HTTP/REST APIs; the lack of authentication means any network-accessible attacker (local network or internet-routable depending on deployment) can directly query API endpoints without credentials. This is a fundamental API security flaw where sensitive operations or data retrieval are exposed without access controls, a common issue in IoT and charging infrastructure devices that may prioritize ease-of-use over security.

RemediationAI

Immediate: Restrict network access to Pile API endpoints using firewall rules, network segmentation, or IP allowlisting if the charging stations are not required to be internet-accessible. Isolate MaxiCharger AC Wallbox Commercial units to trusted networks only. 2. Urgent: Contact Autel support for available firmware patches or security updates addressing CWE-306 authentication enforcement. Check Autel's security advisory portal for CVE-2025-6678 patch availability and deployment instructions. 3. Short-term: If patches are unavailable, implement API gateway authentication or reverse proxy controls (e.g., nginx, WAF) in front of the Pile API endpoint to enforce authentication before allowing access. 4. Monitoring: Audit logs for unauthorized API access attempts to the Pile API; rotate any credentials that may have been exposed via this vulnerability. 5. Long-term: Migrate to patched firmware versions once available and implement ongoing API security testing as part of the charging infrastructure maintenance schedule.