CVE-2025-5827: Autel MaxiCharger AC Elite C50 RCE Flaw

CVE-2025-5827 Overview

CVE-2025-5827 is a stack-based buffer overflow [CWE-121] in the ble_process_esp32_msg function of Autel MaxiCharger AC Wallbox Commercial electric vehicle (EV) chargers. The flaw allows network-adjacent attackers to execute arbitrary code on affected devices without authentication. The vulnerability stems from improper validation of the length of user-supplied data before it is copied to a fixed-length stack buffer over Bluetooth Low Energy (BLE). Successful exploitation grants code execution in the context of the charger firmware, enabling full device compromise. The issue was reported through the Zero Day Initiative as ZDI-CAN-26369 and disclosed in advisory ZDI-25-346.

Critical Impact
An unauthenticated attacker within BLE range can execute arbitrary code on the EV charger, potentially manipulating charging behavior, pivoting onto connected networks, or bricking the device.

Affected Products

Autel MaxiCharger AC Elite Business C50, AC Pro, and AC Ultra (American and European standard firmware)
Autel MaxiCharger DC Compact Mobile, DC Compact Pedestal, DC Fast, DC HiPower, and DH480
Autel MaxiCharger Single Charger firmware (American and European standard)

Discovery Timeline

2025-06-25 - CVE-2025-5827 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-5827

Vulnerability Analysis

The vulnerability resides in ble_process_esp32_msg, a handler responsible for processing BLE messages sent to the ESP32 component of the MaxiCharger. The function copies attacker-controlled data from an incoming BLE message into a fixed-size buffer on the stack without first checking the length of the supplied data. By sending an oversized message field, an attacker overwrites adjacent stack memory, including saved return addresses and control structures. This corruption is sufficient to redirect execution to attacker-supplied content and run arbitrary code in the firmware context.

Because the vulnerable code path is reachable over the BLE interface, exploitation does not require credentials, pairing with the charger management cloud, or any user interaction. The attack vector is limited to adjacent network range, but BLE proximity is achievable in commercial parking facilities, fleet depots, and public charging locations.

Root Cause

The root cause is the absence of bounds checking on user-supplied input prior to a copy into a fixed-length stack buffer, the canonical pattern for [CWE-121] stack-based buffer overflows. The handler trusts a length or terminator value from the BLE payload and writes past the buffer boundary.

Attack Vector

An attacker within BLE radio range crafts a malicious ESP32 message containing an over-length field. When the charger processes the frame in ble_process_esp32_msg, the oversized copy corrupts the stack and transfers execution to attacker-controlled data. Technical details are documented in the Zero Day Initiative Advisory ZDI-25-346.

Detection Methods for CVE-2025-5827

Indicators of Compromise

Unexpected BLE advertising, scanning, or pairing attempts in the vicinity of deployed MaxiCharger units.
Chargers rebooting, crashing, or entering unresponsive states without operator action.
Anomalous outbound network connections from chargers to unknown destinations following BLE activity.
Unauthorized firmware configuration changes or modifications to charging session parameters.

Detection Strategies

Monitor BLE airspace near commercial charging deployments for unauthorized devices issuing crafted ESP32 protocol messages.
Correlate charger crash and watchdog reset events with proximate BLE activity captured by site sensors.
Inspect upstream network telemetry from chargers for command-and-control patterns originating after BLE interactions.

Monitoring Recommendations

Enable verbose logging on chargers and forward events to a centralized SIEM for correlation across the fleet.
Deploy wireless intrusion detection capable of capturing BLE frames near high-value charging sites.
Alert on repeated charger reboots, firmware integrity check failures, or unexpected configuration writes.

How to Mitigate CVE-2025-5827

Immediate Actions Required

Inventory all Autel MaxiCharger units across AC and DC product lines and identify firmware versions in use.
Apply the vendor firmware update referenced in ZDI-25-346 as soon as it is available for each model.
Restrict physical and radio access to charger BLE interfaces, particularly in publicly accessible locations.
Segment chargers onto isolated network zones to limit lateral movement if a unit is compromised.

Patch Information

Refer to Autel for the firmware release addressing CVE-2025-5827 across the MaxiCharger AC Elite Business C50, AC Pro, AC Ultra, DC Compact Mobile, DC Compact Pedestal, DC Fast, DC HiPower, DH480, and Single Charger product lines in both American and European standard variants. The Zero Day Initiative advisory ZDI-25-346 is the authoritative public reference.

Workarounds

Disable the BLE configuration interface on chargers when it is not actively required for commissioning or maintenance.
Limit the time window during which BLE pairing is open to reduce the exposure surface during installation.
Enforce physical security controls around chargers to prevent attackers from approaching within BLE radio range.

bash

# Example: isolate chargers on a dedicated VLAN and block lateral access
# (adapt to your network platform)
vlan 320
 name ev-chargers
interface range Gi1/0/10 - 24
 switchport mode access
 switchport access vlan 320
 spanning-tree portfast
ip access-list extended EV-CHARGER-ISOLATE
 permit tcp 10.20.30.0 0.0.0.255 host <charger-mgmt-server> eq 443
 deny ip 10.20.30.0 0.0.0.255 10.0.0.0 0.255.255.255
 permit ip 10.20.30.0 0.0.0.255 any