CVE-2024-23958: Autel Maxicharger Auth Bypass Flaw

CVE-2024-23958 Overview

CVE-2024-23958 is an authentication bypass vulnerability affecting the Autel MaxiCharger AC Elite Business C50 electric vehicle charging station. The flaw resides in the Bluetooth Low Energy (BLE) AppAuthenRequest command handler, which uses hardcoded credentials as a fallback path when an authentication request fails. A network-adjacent attacker within BLE range can leverage these embedded credentials to bypass authentication without any prior access or user interaction. The issue was reported through the Zero Day Initiative as ZDI-CAN-23196 and is tracked as CWE-798: Use of Hard-coded Credentials.

Critical Impact
Attackers within BLE range can bypass authentication on affected chargers, obtaining full control over charging operations, configuration, and connected vehicle sessions.

Affected Products

Autel MaxiCharger AC Elite Business C50 (hardware)
Autel MaxiCharger AC Elite Business C50 firmware version 1.32.00
Deployments exposing BLE within attacker-adjacent radio range

Discovery Timeline

2024-09-28 - CVE-2024-23958 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23958

Vulnerability Analysis

The MaxiCharger AC Elite Business C50 exposes a BLE interface used by the Autel mobile application to pair with and configure the charger. Authentication between the mobile app and the charger is negotiated through the AppAuthenRequest command handler on the device firmware.

When the handler cannot successfully process an authentication request, it falls back to a set of hardcoded credentials embedded in firmware version 1.32.00. Because the fallback path accepts these embedded credentials as valid, an attacker can deliberately trigger the failure condition and authenticate using the static secret. The vulnerability requires no legitimate user credentials, no prior session, and no user interaction on the charger.

Successful exploitation grants the attacker the same trust level as a paired mobile client, enabling command execution against the charger's BLE service. This affects the confidentiality, integrity, and availability of the device and any charging session it manages.

Root Cause

The root cause is CWE-798: Use of Hard-coded Credentials. Firmware developers included static credentials as a recovery path in the authentication routine rather than failing closed. Because the credentials are compiled into the firmware image, they are shared across every deployed unit and cannot be rotated by operators.

Attack Vector

Exploitation requires the attacker to be within BLE radio range of the target charger, typically tens of meters. The attacker initiates a BLE connection, issues an AppAuthenRequest crafted to trigger the failure branch, and then presents the hardcoded credentials the handler accepts as its fallback. Once authenticated, the attacker can interact with subsequent BLE command handlers exposed by the firmware.

The vulnerability manifests inside the firmware's BLE authentication logic. Detailed reverse-engineering notes are available in the Zero Day Initiative Advisory ZDI-24-852.

Detection Methods for CVE-2024-23958

Indicators of Compromise

Unexpected BLE pairing or AppAuthenRequest transactions on chargers outside of normal operator or customer activity windows
Charging sessions started, stopped, or reconfigured without a corresponding record in the Autel cloud or operator backend
Firmware, network, or ratings parameters changed on the charger without an authorized maintenance event
Repeated authentication failures immediately followed by a successful session, indicating the fallback path was reached

Detection Strategies

Monitor the charger's operator backend logs for authentication events that do not correlate with a known technician or user session
Deploy BLE monitoring in sensitive deployment locations to capture connection attempts from unknown client MAC addresses
Alert on configuration or firmware changes to MaxiCharger units that are not sourced from a change-management ticket
Compare deployed firmware version strings against the vendor-approved baseline; flag any unit still on 1.32.00

Monitoring Recommendations

Ingest charger backend and OCPP session logs into a centralized SIEM or data lake for correlation with physical access records
Establish a baseline of expected BLE clients per site and alert on new device identifiers connecting to chargers
Track authentication failure to success transitions as a distinct detection signal for the fallback credential path

How to Mitigate CVE-2024-23958

Immediate Actions Required

Inventory all Autel MaxiCharger AC Elite Business C50 units and identify those running firmware 1.32.00
Apply the vendor-supplied firmware update as soon as it is available for each affected unit
Restrict physical access to charger locations to reduce opportunities for adjacent BLE attackers
Rotate any operator or backend credentials that may have been stored on or issued to compromised chargers

Patch Information

At the time of publication, no vendor advisory URL is listed in NVD for CVE-2024-23958. Operators should contact Autel directly and reference Zero Day Initiative Advisory ZDI-24-852 to obtain firmware updates that remove the hardcoded fallback credentials from the AppAuthenRequest handler.

Workarounds

Disable BLE pairing on the charger when it is not actively required for commissioning or maintenance
Physically shield or relocate chargers to limit BLE signal exposure to public or attacker-controlled areas
Enforce out-of-band verification (site visit, ticketing) before accepting configuration changes reported by the charger
Segment charger management networks from corporate and customer networks to contain post-exploitation activity

bash

# Example: verify deployed MaxiCharger firmware versions against a known-good baseline
# (run from the operator management backend or inventory system)
AFFECTED_VERSION="1.32.00"
while read -r charger_id fw_version; do
  if [ "$fw_version" = "$AFFECTED_VERSION" ]; then
    echo "[VULNERABLE] Charger $charger_id running $fw_version - schedule firmware update"
  fi
done < charger_inventory.tsv