Maxicharger Ac Elite Business C50 Firmware EUVD-2025-28672

This vulnerability presents HIGH real-world risk across multiple dimensions: (1) CVSS 8.8 with network-adjacent attack vector (AV:A) and zero privilege requirements (PR:N) indicates significant exploitability; (2) the vulnerability affects critical infrastructure (EV charging networks), which are high-value targets; (3) lack of authentication requirement (UI:N) dramatically reduces attack complexity; (4) heap-based buffer overflow is reliably exploitable for RCE; (5) ZDI designation (ZDI-CAN-26327) indicates coordinated disclosure and likely POC development by security researchers. The AC:L (Low Complexity) rating confirms this is trivial to exploit once the message format is known. While specific EPSS and KEV status data were not provided, the combination of unauthenticated network access, infrastructure targeting, and RCE capability classify this as critical priority. This is NOT a high-CVSS-but-low-risk issue—this is a genuine critical vulnerability requiring immediate attention.

An attacker on the same network segment as an Autel MaxiCharger AC Wallbox Commercial device crafts a malicious DLB_SlaveRegister message with a length field indicating a payload larger than the internal fixed-length heap buffer. Upon receipt, the device firmware copies this oversized payload without validation, triggering a heap buffer overflow. The attacker carefully structures the payload to overwrite heap metadata or adjacent function pointers, redirecting code execution to attacker-controlled shellcode. Since the attack vector is network-adjacent (AV:A) rather than network (AV:N), the attacker must be on the same network segment (e.g., same building's WiFi or wired network), or have compromised an intermediate network device. No authentication is required, making this exploitable by any network-adjacent device without credentials. The attacker gains complete code execution on the charging station, potentially disrupting EV charging services, exfiltrating payment or user data, or using the device as a pivot point for further network attacks. A proof-of-concept likely exists given the ZDI designation and researcher involvement.