Maxicharger Ac Elite Business C50 Firmware EUVD-2025-28665

This vulnerability presents a HIGH real-world risk across multiple dimensions: (1) CVSS 8.8 with AV:N/AC:L/PR:L indicates network-accessible exploitation with low complexity requiring only low-privilege credentials—realistic for attackers who compromise service accounts or partner integrations; (2) The PR:L (low privilege requirement) is the critical factor—an attacker needs only a technician or basic service account, not zero-authentication; (3) The full impact (C:H/I:H/A:H) means confidentiality, integrity, and availability are all compromised, allowing data theft, station manipulation, and denial of service; (4) Commercial charging infrastructure is increasingly targeted by threat actors seeking to disrupt operations or extort operators; (5) The ZDI designation (ZDI-CAN-26325) suggests this was submitted to Trend Micro's Zero Day Initiative, indicating researcher confidence in exploitability. Without KEV/CISA status or EPSS data available in the prompt, standard risk assessment suggests this should be prioritized within 30 days based on network exposure and low exploitation complexity. The requirement for a pre-existing token moderately reduces risk compared to unauthenticated vulnerabilities but does not eliminate it—many commercial APIs have broad token distribution or token leakage risks.

An attacker with network access obtains a low-privileged API token, either through purchasing a legitimate service plan, social engineering a technician, or intercepting unencrypted credentials. Using this token, they make API calls to the Technician endpoint that would normally require administrative privileges—for example, querying charging usage data from all stations, modifying pricing/billing parameters, disabling safety features, or triggering firmware updates. Due to insufficient authorization checks, the API processes these requests. The attacker can then extract sensitive data from the commercial charging network, manipulate charging behavior to cause operational disruption, or pivot to other infrastructure. In a more sophisticated scenario, an attacker compromises a partner service provider's account, which legitimately receives low-privilege API access for maintenance, and escalates privileges to affect the entire network of charging stations served by that partner. The attack requires no user interaction (UI:N) and can be fully automated, making it suitable for large-scale compromise of commercial EV infrastructure.