CVE-2025-5824: Autel MaxiCharger Auth Bypass Vulnerability

CVE-2025-5824 Overview

CVE-2025-5824 is an authentication bypass vulnerability affecting Autel MaxiCharger AC Wallbox Commercial electric vehicle charging stations. The flaw resides in the Bluetooth pairing request handler, which fails to properly validate the origin of incoming commands [CWE-346]. A network-adjacent attacker capable of pairing a malicious Bluetooth device with a target charger can bypass authentication on the affected installation. The issue was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-26353 and disclosed in advisory ZDI-25-343. The vulnerability impacts the full MaxiCharger product line, including AC and DC variants distributed under both American and European standards.

Critical Impact
A successful attack lets an adjacent attacker bypass authentication on the charger, gaining the ability to issue privileged commands that affect charging operations, configuration, and device integrity.

Affected Products

Autel MaxiCharger AC Elite Business C50, AC Pro, and AC Ultra (American and European standard firmware)
Autel MaxiCharger DC Compact Mobile, DC Compact Pedestal, DC Fast, and DC HiPower (American and European standard firmware)
Autel MaxiCharger DH480 and MaxiCharger Single Charger (American and European standard firmware)

Discovery Timeline

2025-06-25 - CVE-2025-5824 published to the National Vulnerability Database
2025-09-10 - Last updated in NVD database

Technical Details for CVE-2025-5824

Vulnerability Analysis

The vulnerability is an Origin Validation Error in the Bluetooth pairing subsystem of the MaxiCharger firmware. When the charger receives a pairing request over Bluetooth, the handler does not adequately verify that the command originates from a trusted source. This logic gap allows a paired but unauthorized Bluetooth peer to issue commands that should require prior authentication.

Exploitation requires the attacker to be within Bluetooth range and to successfully complete the pairing handshake with the target charger. Once paired, the attacker can issue protocol messages that the device processes as if they came from a legitimate, authenticated controller. Because the affected products are commercial EV charging units commonly deployed in fleet depots, parking garages, and public charging sites, an attacker with physical proximity has a realistic operational window.

The impact extends across confidentiality, integrity, and availability of the charger. An attacker can read device state, alter configuration, and disrupt charging sessions. The flaw is tracked as ZDI-CAN-26353 by the Trend Micro Zero Day Initiative.

Root Cause

The root cause is insufficient validation of the origin of commands received through the Bluetooth pairing flow [CWE-346]. The firmware trusts the transport channel rather than cryptographically binding commands to an authenticated session, which permits a malicious paired device to act as a privileged controller.

Attack Vector

The attack vector is Adjacent (Bluetooth radio range). The attacker must first pair a malicious Bluetooth device with the target MaxiCharger. After pairing, the attacker sends crafted pairing or post-pairing commands that the firmware accepts without verifying the originator. No user interaction on the charger side is required, and no prior credentials are needed beyond achieving the pairing state.

No public proof-of-concept code is available. Technical specifics are limited to the ZDI advisory; see the Zero Day Initiative Advisory ZDI-25-343 for the disclosure details.

Detection Methods for CVE-2025-5824

Indicators of Compromise

Unexpected Bluetooth pairing events on MaxiCharger units, particularly from unknown device addresses or names not matching authorized maintenance hardware.
Configuration changes, firmware setting modifications, or charging session interruptions that do not correlate with operator activity logged in the Autel management portal.
Repeated Bluetooth connection attempts originating from devices in proximity to public or fleet charging stations outside normal service windows.

Detection Strategies

Centralize charger event logs, including Bluetooth pairing and authentication events, in a SIEM or data lake and alert on pairings from non-allowlisted device identifiers.
Correlate charger state changes and command execution events with the source channel; flag administrative commands that arrive over Bluetooth rather than the management network.
Perform periodic Bluetooth Low Energy scans near deployed chargers to identify rogue devices attempting to pair.

Monitoring Recommendations

Monitor the Autel cloud management console for unexplained configuration drift, firmware setting changes, or unauthorized charging sessions.
Track physical access logs at charger locations and correlate with anomalous device telemetry to identify proximity-based abuse.
Maintain an inventory of authorized maintenance Bluetooth devices and alert on any deviation from the approved list.

How to Mitigate CVE-2025-5824

Immediate Actions Required

Inventory all deployed Autel MaxiCharger units across AC and DC product lines and identify firmware versions in production.
Disable Bluetooth pairing on chargers when active maintenance is not in progress, where the firmware exposes this control.
Restrict physical access to chargers and post-pairing maintenance windows to authorized technicians only.

Patch Information

At the time of publication, no vendor advisory URL or fixed firmware version is listed in the enriched CVE data. Operators should contact Autel support directly and monitor the Zero Day Initiative Advisory ZDI-25-343 for updates on a coordinated firmware release.

Workarounds

Limit Bluetooth radio exposure by enabling pairing only during scheduled service intervals and disabling it otherwise.
Deploy chargers in physically controlled locations where unauthorized parties cannot remain within Bluetooth range undetected.
Require technicians to use a fixed allowlist of maintenance Bluetooth devices and rotate or revoke pairings after each service visit.

bash

# Operational hardening checklist (manual procedure)
# 1. Audit charger firmware versions through the Autel management console
# 2. Disable Bluetooth pairing mode outside maintenance windows
# 3. Remove unknown paired devices from each charger's bonded device list
# 4. Forward charger telemetry and pairing events to a central SIEM