Maxicharger Ac Elite Business C50 Firmware EUVD-2025-28667

The real-world risk is substantial but constrained by prerequisite complexity. CVSS 7.5 reflects high impact (CIA all 'H'), but the vector analysis reveals important context: AV:A (Adjacent) and AC:H (High Complexity) reduce practical exploitability compared to CVSS:3.0/AV:N scores. The requirement for prior Bluetooth pairing (PR:N but with implicit device proximity/pairing requirement) creates a meaningful operational barrier—an attacker cannot exploit this remotely without first compromising the Bluetooth pairing process or gaining physical proximity to pair a device. However, in commercial charging networks where multiple devices operate in proximity (parking lots, fleet depots, charging hubs), this attack surface expands significantly. The lack of firmware signature validation (CWE-1328) is a critical design flaw that enables supply-chain and in-network attacks. The ZDI coordination status and prior vulnerability reference (ZDI-CAN-26354) suggest this is part of a coordinated disclosure pattern for this product line, indicating potential researcher interest and possible POC development. Without KEV listing or EPSS data provided, but given the High CVSS, commercial targeting, and infrastructure context, this should be prioritized for patching in operational deployments, particularly in fleet charging environments where attacker proximity is more feasible.

An attacker with physical or close proximity access to a commercial charging station network (e.g., in a parking lot, fleet depot, or charging hub) performs Bluetooth discovery and pairs a malicious device with an Autel MaxiCharger AC Wallbox Commercial unit. Once paired, the attacker crafts a malicious firmware image containing arbitrary code (e.g., credential theft, command execution, network reconnaissance, or lateral movement payload) and initiates a firmware update via the Bluetooth interface. Because the firmware update mechanism lacks signature verification (CWE-1328), the device accepts and flashes the malicious firmware without validation. Upon reboot, the compromised firmware executes the attacker's payload with device privileges, potentially allowing credential exfiltration from the charging network, modifications to charging logic, denial of service, or lateral attacks into the facility network. In fleet scenarios where charging infrastructure management is centralized, a single compromised station could serve as a pivot point for further attacks. Attack complexity is rated 'High' because the attacker must successfully pair a Bluetooth device (requiring proximity and pairing acceptance or exploitation of Bluetooth pairing mechanisms), making opportunistic mass exploitation unlikely, but targeted attacks on known facilities feasible.