CVE-2025-5823

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-5823", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2025-06-06T19:16:38.423Z", "datePublished": "2025-06-25T18:01:07.948Z", "dateUpdated": "2025-06-26T13:17:04.941Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2025-06-25T18:01:07.948Z"}, "title": "Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability", "descriptions": [{"lang": "en", "value": "Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351."}], "affected": [{"vendor": "Autel", "product": "Autel MaxiCharger AC Wallbox Commercial", "versions": [{"version": "1.36.00", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-749", "description": "CWE-749: Exposed Dangerous Method or Function", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-341/", "name": "ZDI-25-341", "tags": ["x_research-advisory"]}], "dateAssigned": "2025-06-06T19:16:38.454Z", "datePublic": "2025-06-11T17:27:01.850Z", "source": {"lang": "en", "value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-26T13:16:57.354561Z", "id": "CVE-2025-5823", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-26T13:17:04.941Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5823", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-26T13:16:57.354561Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-26T13:17:01.195Z"}}], "cna": {"title": "Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability", "source": {"lang": "en", "value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "Autel", "product": "Autel MaxiCharger AC Wallbox Commercial", "versions": [{"status": "affected", "version": "1.36.00"}], "defaultStatus": "unknown"}], "datePublic": "2025-06-11T17:27:01.850Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-341/", "name": "ZDI-25-341", "tags": ["x_research-advisory"]}], "dateAssigned": "2025-06-06T19:16:38.454Z", "descriptions": [{"lang": "en", "value": "Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-749", "description": "CWE-749: Exposed Dangerous Method or Function"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2025-06-25T18:01:07.948Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5823", "state": "PUBLISHED", "dateUpdated": "2025-06-26T13:17:04.941Z", "dateReserved": "2025-06-06T19:16:38.423Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2025-06-25T18:01:07.948Z", "assignerShortName": "zdi"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Autel MaxiCharger AC Wallbox Commercial", "vendor": "Autel", "versions": [{"status": "affected", "version": "1.36.00"}]}], "source": "zdi-disclosures@trendmicro.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware:*:*:*:*:*:*:*:american_standard", "matchCriteriaId": "0C17A950-221C-41E3-9BE3-31736CE4516F", "versionEndExcluding": "1.39.51", "vulnerable": true}, {"criteria": "cpe:2.3:o:autel:maxicharger_ac_elite_business_c50_firmware:*:*:*:*:*:*:*:european_standard", "matchCriteriaId": "42F0DDFA-A1B9-4EC2-8F43-3261F9BCE814", "versionEndExcluding": "1.56.51", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:autel:maxicharger_ac_elite_business_c50:-:*:*:*:*:*:*:*", "matchCriteriaId": "5B2F9001-71B7-4B39-9114-FC54F4EAE9E7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:autel:maxicharger_ac_pro_firmware:*:*:*:*:*:*:*:american_standard", "matchCriteriaId": "9471EA48-BD48-40AA-8FF7-28503D04D1F0", "versionEndExcluding": "1.39.51", "vulnerable": true}, {"criteria": "cpe:2.3:o:autel:maxicharger_ac_pro_firmware:*:*:*:*:*:*:*:european_standard", "matchCriteriaId": "72FB45A6-E876-45A6-A39F-4E0B28620A71", "versionEndExcluding": "1.56.51", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:autel:maxicharger_ac_pro:-:*:*:*:*:*:*:*", "matchCriteriaId": "92CF3B40-B18F-4C4D-8A6C-68A8B1F288AE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:autel:maxicharger_ac_ultra_firmware:*:*:*:*:*:*:*:american_standard", "matchCriteriaId": "55C717AF-39F9-4080-AE56-7511E0F62F79", "versionEndExcluding": "1.39.51", "vulnerable": true}, {"criteria": "cpe:2.3:o:autel:maxicharger_ac_ultra_firmware:*:*:*:*:*:*:*:european_standard", "matchCriteriaId": "7AFD91E7-E581-451B-AB15-099AA7A4F611", "versionEndExcluding": "1.56.51", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:autel:maxicharger_ac_ultra:-:*:*:*:*:*:*:*", "matchCriteriaId": "CDC6E5EB-C4D4-4488-B01B-C0E568FCA0D1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware:*:*:*:*:*:*:*:american_standard", "matchCriteriaId": "2C9AEB54-FFBC-4B24-AC7B-1B5F3CC762DF", "versionEndExcluding": "1.39.51", "vulnerable": true}, {"criteria": "cpe:2.3:o:autel:maxicharger_dc_compact_mobile_firmware:*:*:*:*:*:*:*:european_standard", "matchCriteriaId": "BBFCD8D0-53E7-4B06-B763-36381E13DD26", "versionEndExcluding": "1.56.51", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:autel:maxicharger_dc_compact_mobile:-:*:*:*:*:*:*:*", "matchCriteriaId": "52578631-C18D-4244-9377-AB787EDE08A1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware:*:*:*:*:*:*:*:american_standard", "matchCriteriaId": "FED7B2BF-5D38-4393-9986-588407A3476D", "versionEndExcluding": "1.39.51", "vulnerable": true}, {"criteria": "cpe:2.3:o:autel:maxicharger_dc_compact_pedestal_firmware:*:*:*:*:*:*:*:european_standard", "matchCriteriaId": "3244FD64-1714-4597-BA66-CC5FC8D514FF", "versionEndExcluding": "1.56.51", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:autel:maxicharger_dc_compact_pedestal:-:*:*:*:*:*:*:*", "matchCriteriaId": "ED75BBD9-D889-49D3-95B0-EF6F15B65E10", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:autel:maxicharger_dc_fast_firmware:*:*:*:*:*:*:*:american_standard", "matchCriteriaId": "264E7F9D-0603-43C9-B7A9-6A35EA8F0063", "versionEndExcluding": "1.39.51", "vulnerable": true}, {"criteria": "cpe:2.3:o:autel:maxicharger_dc_fast_firmware:*:*:*:*:*:*:*:european_standard", "matchCriteriaId": "E5F4FE58-5AA6-45D0-AE48-959DA0CF53C8", "versionEndExcluding": "1.56.51", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:autel:maxicharger_dc_fast:-:*:*:*:*:*:*:*", "matchCriteriaId": "6C8B42B3-3F66-426F-8FFE-993FCAA12EB4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:autel:maxicharger_dc_hipower_firmware:*:*:*:*:*:*:*:american_standard", "matchCriteriaId": "E30E7592-29C4-4333-A02C-7468074BD104", "versionEndExcluding": "1.39.51", "vulnerable": true}, {"criteria": "cpe:2.3:o:autel:maxicharger_dc_hipower_firmware:*:*:*:*:*:*:*:european_standard", "matchCriteriaId": "F9058C73-831E-48BF-AE9B-19AB33F10F14", "versionEndExcluding": "1.56.51", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:autel:maxicharger_dc_hipower:-:*:*:*:*:*:*:*", "matchCriteriaId": "EE5DF603-DBD2-4AFF-AE3D-946277C2C6C2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:autel:maxicharger_dh480_firmware:*:*:*:*:*:*:*:american_standard", "matchCriteriaId": "33F4A529-54C4-4EBC-871E-5E0C71859F69", "versionEndExcluding": "1.39.51", "vulnerable": true}, {"criteria": "cpe:2.3:o:autel:maxicharger_dh480_firmware:*:*:*:*:*:*:*:european_standard", "matchCriteriaId": "62718E33-B591-49D4-8CC6-057D6254873A", "versionEndExcluding": "1.56.51", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:autel:maxicharger_dh480:-:*:*:*:*:*:*:*", "matchCriteriaId": "CAD62E93-8613-48DF-9C42-B12655FE1680", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:autel:maxicharger_single_charger_firmware:*:*:*:*:*:*:*:american_standard", "matchCriteriaId": "372D3478-67AA-4D41-908C-5CFE6CAA25A8", "versionEndExcluding": "1.39.51", "vulnerable": true}, {"criteria": "cpe:2.3:o:autel:maxicharger_single_charger_firmware:*:*:*:*:*:*:*:european_standard", "matchCriteriaId": "8ED07235-5610-4E80-8940-6EB942CC648C", "versionEndExcluding": "1.56.51", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:autel:maxicharger_single_charger:-:*:*:*:*:*:*:*", "matchCriteriaId": "0E6B2074-D4A6-424F-B7C5-40A0FE5C17F8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351."}, {"lang": "es", "value": "Vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n por m\u00e9todo peligroso expuesta en el n\u00famero de serie del Autel MaxiCharger AC Wallbox Commercial. Esta vulnerabilidad permite a atacantes remotos divulgar informaci\u00f3n confidencial sobre las instalaciones afectadas de los cargadores para veh\u00edculos el\u00e9ctricos Autel MaxiCharger AC Wallbox Commercial. Se requiere autenticaci\u00f3n para explotar esta vulnerabilidad. La falla espec\u00edfica se encuentra en la implementaci\u00f3n de la API Autel Technician. El problema se debe a un m\u00e9todo peligroso expuesto. Un atacante puede aprovechar esta vulnerabilidad para divulgar credenciales, lo que conlleva una mayor vulnerabilidad. Se denomin\u00f3 ZDI-CAN-26351."}], "id": "CVE-2025-5823", "lastModified": "2026-06-17T09:48:48.993", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5823", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-26T13:16:57.354561Z", "version": "2.0.3"}}]}, "published": "2025-06-25T18:15:23.043", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-341/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-749"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{}

{}