What is the CVSS score of EUVD-2025-28666?

EUVD-2025-28666 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Maxicharger Ac Elite Business C50 Firmware are affected by EUVD-2025-28666?

CVE-2025-5823 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate EUVD-2025-28666?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Maxicharger Ac Elite Business C50 Firmware EUVD-2025-28666

| CVE-2025-5823 MEDIUM

Exposed Dangerous Method or Function (CWE-749)

2025-06-25 zdi-disclosures@trendmicro.com

Information Disclosure Maxicharger Ac Elite Business C50 Firmware Maxicharger Ac Pro Firmware Maxicharger Ac Ultra Firmware Maxicharger Dc Compact Mobile Firmware Maxicharger Dc Compact Pedestal Firmware Maxicharger Dc Fast Firmware Maxicharger Dc Hipower Firmware Maxicharger Dh480 Firmware Maxicharger Single Charger Firmware

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-28666

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

CVE Published

Jun 25, 2025 - 18:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351.

Analysis

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls.