CVE-2025-5822 Overview
CVE-2025-5822 is an incorrect authorization vulnerability [CWE-863] in the Autel MaxiCharger Technician API. The flaw allows authenticated remote attackers holding a low-privileged token to escalate privileges and access resources reserved for higher-privileged technician roles. The issue affects multiple AC and DC MaxiCharger models in both American and European standard firmware variants. The Zero Day Initiative tracked the issue as ZDI-CAN-26325 and published advisory ZDI-25-340.
Critical Impact
An attacker with a valid low-privileged token can escalate to technician-level privileges over the network, gaining control over charging station configuration, diagnostics, and operational state.
Affected Products
- Autel MaxiCharger AC Elite Business C50, AC Pro, and AC Ultra firmware (American and European standard)
- Autel MaxiCharger DC Compact Mobile, DC Compact Pedestal, DC Fast, and DC HiPower firmware
- Autel MaxiCharger DH480 and MaxiCharger Single Charger firmware
Discovery Timeline
- 2025-06-25 - CVE-2025-5822 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5822
Vulnerability Analysis
The Autel MaxiCharger Technician API performs authorization checks that do not properly validate the privilege level associated with the requesting token. An attacker who obtains any valid low-privileged authorization token, such as one issued to a standard user account or paired mobile application, can invoke API endpoints intended only for technicians or administrators. The result is a vertical privilege escalation across the charging station's management surface.
Because the MaxiCharger product family shares the same Technician API implementation, the flaw extends across AC wallboxes used in commercial and residential deployments and DC fast chargers used in public charging networks. The attacker requires network reachability to the API and no user interaction. Successful exploitation impacts confidentiality, integrity, and availability of the charging station.
Root Cause
The root cause is incorrect authorization logic within the Technician API request handlers. The API authenticates the bearer token but fails to enforce that the token's role or scope matches the privileges required by the requested operation. This corresponds to CWE-863: Incorrect Authorization, in which an access control decision is made but the decision is based on an incorrect comparison or missing role check.
Attack Vector
Exploitation requires the attacker to first acquire a low-privileged authorization token. This token can be obtained through legitimate account creation, account compromise, or pairing flows exposed by the MaxiCharger ecosystem. The attacker then issues HTTPS requests to privileged Technician API endpoints, supplying the low-privileged token. The API processes the request as if the caller were authorized, returning sensitive data or executing privileged operations such as configuration changes.
For technical specifics, refer to the Zero Day Initiative Advisory ZDI-25-340.
Detection Methods for CVE-2025-5822
Indicators of Compromise
- API request logs showing low-privileged accounts invoking Technician API endpoints normally restricted to administrative roles.
- Unexpected configuration changes on MaxiCharger units, including modified charging parameters, OCPP server endpoints, or firmware update settings.
- Sudden role or permission changes associated with accounts that have not gone through a documented onboarding process.
Detection Strategies
- Inspect server-side authorization logs for HTTP 200 responses to privileged Technician API routes called by tokens with non-technician role claims.
- Correlate token issuance events with subsequent privileged API calls to identify accounts performing operations outside their normal scope.
- Monitor for repeated enumeration of Technician API endpoints originating from the same authenticated session or IP address.
Monitoring Recommendations
- Forward MaxiCharger backend and API gateway logs to a centralized SIEM with OCSF normalization for behavioral analysis.
- Alert on any privileged Technician API invocation where the caller's role claim is not in an approved allow-list.
- Track configuration drift on charging stations and trigger alerts on unauthorized parameter modifications.
How to Mitigate CVE-2025-5822
Immediate Actions Required
- Apply the firmware update provided by Autel for each affected MaxiCharger model as soon as it is available through the vendor's update channel.
- Audit all issued API tokens and revoke tokens belonging to accounts that should not retain access.
- Restrict network exposure of the Technician API to known management networks where feasible.
Patch Information
Autel has not published a public security advisory in the NVD references for CVE-2025-5822. Operators should contact Autel support and consult the Zero Day Initiative Advisory ZDI-25-340 for vendor remediation status and firmware version guidance.
Workarounds
- Limit account creation and token issuance to vetted users until patched firmware is deployed across the fleet.
- Place MaxiCharger management interfaces behind a VPN or zero-trust gateway that enforces additional authentication and role validation.
- Enable enhanced logging on the API gateway and review privileged endpoint access daily until remediation is confirmed.
# Example: restrict access to the Technician API at the network edge
# Replace 10.10.0.0/24 with your authorized management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
