CVE-2025-5825 Overview
CVE-2025-5825 is a firmware downgrade vulnerability affecting Autel MaxiCharger AC Wallbox Commercial charging stations. The flaw resides in the firmware update process, which fails to properly validate firmware images before applying an upgrade. Network-adjacent attackers who can pair a malicious Bluetooth device with the target station can leverage this weakness, in combination with other vulnerabilities, to execute arbitrary code in the context of the device. The issue is tracked as ZDI-CAN-26354 and is categorized under [CWE-1328] (Security Version Number Mutable to Older Versions). The vulnerability impacts a broad portfolio of Autel AC and DC charging products across both American and European standards.
Critical Impact
Successful exploitation allows network-adjacent attackers to downgrade firmware and execute arbitrary code on commercial electric vehicle charging infrastructure.
Affected Products
- Autel MaxiCharger AC Elite Business C50, AC Pro, AC Ultra (American and European standards)
- Autel MaxiCharger DC Compact Mobile, DC Compact Pedestal, DC Fast, DC HiPower, DH480
- Autel MaxiCharger Single Charger firmware
Discovery Timeline
- 2025-06-25 - CVE-2025-5825 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5825
Vulnerability Analysis
The vulnerability exists in the firmware update routine of Autel MaxiCharger devices. The update process accepts firmware images without enforcing version-rollback protections or cryptographic validation that would reject older or untrusted images. An attacker who has paired a malicious Bluetooth device with the charging station can deliver a downgraded firmware payload to the update handler. Downgrading reintroduces previously patched vulnerabilities, which the attacker can chain with other flaws to gain arbitrary code execution on the device. Because the affected devices are commercial EV charging stations, compromised firmware can persist across reboots and provide a foothold inside operational technology networks.
Root Cause
The root cause is the absence of a mutable security version check and integrity validation during firmware updates, mapped to [CWE-1328]. The update process trusts the supplied image without verifying that its version is equal to or greater than the currently installed firmware, and without enforcing signature checks that would block attacker-supplied images. This design weakness enables rollback to firmware containing known exploitable defects.
Attack Vector
Exploitation requires adjacent network access via Bluetooth. The attacker must first achieve a successful Bluetooth pairing with the target charging station, which raises attack complexity. Once paired, the attacker invokes the firmware update interface with a malicious or older firmware image. The lack of proper image validation allows the downgrade to proceed, after which the attacker chains additional vulnerabilities in the downgraded firmware to achieve code execution in the device context. Refer to the Zero Day Initiative Advisory ZDI-25-344 for further technical context.
Detection Methods for CVE-2025-5825
Indicators of Compromise
- Unexpected firmware version downgrades reported by MaxiCharger devices or their management console.
- Unknown or unauthorized Bluetooth pairing events on charging stations.
- Unscheduled firmware update activity originating from non-administrative sources.
Detection Strategies
- Inventory installed firmware versions across the MaxiCharger fleet and alert on any version that regresses from a previously reported value.
- Monitor Bluetooth pairing logs on charging stations for new device identifiers that do not match approved technician hardware.
- Inspect device-side update logs for failed signature checks or firmware images delivered outside of vendor update channels.
Monitoring Recommendations
- Forward charging station telemetry, including firmware version and pairing events, to a centralized SIEM for correlation.
- Establish a baseline of authorized maintenance windows and flag firmware updates that occur outside those windows.
- Track network traffic between charging stations and back-end management systems for anomalous update-related sessions.
How to Mitigate CVE-2025-5825
Immediate Actions Required
- Restrict physical and radio-frequency proximity to deployed MaxiCharger stations to reduce opportunities for Bluetooth pairing by unauthorized devices.
- Disable Bluetooth pairing on charging stations when not actively required for commissioning or maintenance.
- Audit existing Bluetooth pairings and remove any device identifiers that are not explicitly authorized.
Patch Information
No fixed firmware version is listed in the NVD record or the Zero Day Initiative Advisory ZDI-25-344 at the time of publication. Operators should contact Autel directly for remediation guidance and apply vendor-supplied firmware updates as soon as they become available.
Workarounds
- Segment charging station management networks from corporate and operational technology environments to limit lateral movement following compromise.
- Enforce strict access controls on commissioning tools and Bluetooth-capable maintenance equipment used with MaxiCharger devices.
- Schedule recurring firmware version audits and compare results against an authoritative baseline maintained by the operator.
# Example: periodic firmware version audit from a management host
# Replace inventory_source with your fleet management export
while read station_id reported_version expected_version; do
if [ "$reported_version" \< "$expected_version" ]; then
echo "ALERT: $station_id downgraded ($reported_version < $expected_version)"
fi
done < inventory_source.tsv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
