CVE-2025-5822

Q: What is the severity of CVE-2025-5822?

CVE-2025-5822 has a CVSS score of 8.8 (HIGH). This vulnerability allows remote attackers with low-privileged authorization tokens to escalate privileges on Autel MaxiCharger AC Wallbox Commercial charging stations. Attackers can access protected resources normally restricted from their user level. Organizations using these charging stations with the Technician API enabled are affected.

8.8 HIGH

Authentication Bypass

📋 TL;DR

This vulnerability allows remote attackers with low-privileged authorization tokens to escalate privileges on Autel MaxiCharger AC Wallbox Commercial charging stations. Attackers can access protected resources normally restricted from their user level. Organizations using these charging stations with the Technician API enabled are affected.

💻 Affected Systems

Products:

Autel MaxiCharger AC Wallbox Commercial

Versions: Specific versions not disclosed in advisory; all versions with vulnerable Technician API implementation

Operating Systems: Embedded firmware

Default Config Vulnerable: ⚠️ Yes

Notes: Requires Technician API to be enabled and accessible. Charging stations connected to networks with API exposure are vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of charging station management, allowing attackers to disable charging, manipulate billing, access customer data, or potentially cause physical damage through improper charging parameters.

🟠

Likely Case

Unauthorized access to administrative functions, configuration changes, user data exposure, and potential disruption of charging services.

🟢

If Mitigated

Limited impact if proper network segmentation, API access controls, and monitoring are in place to detect and block unauthorized privilege escalation attempts.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires obtaining a low-privileged authorization token first, then exploiting incorrect authorization checks in the Technician API.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Not specified in available references

Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-340/

Restart Required: Yes

Instructions:

1. Contact Autel support for firmware updates. 2. Download latest firmware from Autel portal. 3. Apply firmware update following manufacturer instructions. 4. Restart charging station. 5. Verify API authorization controls are functioning correctly.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate charging stations on separate VLANs with strict firewall rules limiting API access to authorized management systems only.

API Access Restriction

all

Disable Technician API if not required, or restrict access to specific IP addresses using firewall rules.

🧯 If You Can't Patch

Implement strict network segmentation to isolate charging stations from untrusted networks
Deploy API gateway with proper authorization validation and rate limiting

🔍 How to Verify

Check if Vulnerable:

Check if Technician API is accessible and test authorization bypass using low-privilege tokens against protected endpoints.

Check Version:

Check firmware version through charging station web interface or management console

Verify Fix Applied:

After patching, test that low-privilege tokens cannot access administrative functions through the Technician API.

📡 Detection & Monitoring

Log Indicators:

Unauthorized API access attempts
Privilege escalation patterns in API logs
Multiple failed authorization attempts followed by successful administrative access

Network Indicators:

Unusual API traffic patterns
Administrative API calls from non-admin user accounts
Traffic to Technician API endpoints from unexpected sources

SIEM Query:

source="charging_station" AND (event_type="api_access" AND user_role="low_privilege" AND endpoint="admin_*")

📊 Metadata

CVE ID: CVE-2025-5822

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-863

EPSS Score: 0.04% exploit probability (12.7th percentile)

Published: June 25, 2025

Last Updated: September 10, 2025

🔗 References

https://www.zerodayinitiative.com/advisories/ZDI-25-340/ Third Party Advisory