CVE-2025-5830 Overview
CVE-2025-5830 is a heap-based buffer overflow [CWE-122] affecting Autel MaxiCharger AC Wallbox Commercial electric vehicle (EV) chargers. The flaw resides in the handling of DLB_SlaveRegister messages, where user-supplied input is copied into a fixed-length heap buffer without proper length validation. Network-adjacent attackers can exploit the issue without authentication to execute arbitrary code in the context of the device. The vulnerability was originally tracked by the Zero Day Initiative as ZDI-CAN-26327 and published as ZDI-25-349.
Critical Impact
Unauthenticated adjacent-network attackers can achieve arbitrary code execution on Autel MaxiCharger EV chargers, compromising charging operations, connected vehicles, and the broader operational network.
Affected Products
- Autel MaxiCharger AC Elite Business C50, AC Pro, and AC Ultra firmware (American and European standards)
- Autel MaxiCharger DC Compact Mobile, DC Compact Pedestal, DC Fast, and DC HiPower firmware
- Autel MaxiCharger DH480 and Single Charger firmware
Discovery Timeline
- 2025-06-25 - CVE-2025-5830 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5830
Vulnerability Analysis
The vulnerability exists in the Dynamic Load Balancing (DLB) protocol handler used by Autel MaxiCharger devices to coordinate power distribution between master and slave chargers. When a charger processes a DLB_SlaveRegister registration message, it copies attacker-controlled fields from the message into a fixed-length heap buffer. The handler does not validate the length of the supplied data before performing the copy, leading to a heap-based buffer overflow.
Successful exploitation grants the attacker code execution in the context of the charging firmware. Because the flaw is reachable without authentication, any device that can place packets on the same adjacent network segment as a vulnerable charger can trigger the condition.
Root Cause
The root cause is missing bounds checking on user-supplied data prior to a buffer copy operation, classified under CWE-122 (Heap-based Buffer Overflow). The firmware trusts the length and contents of fields contained within incoming DLB_SlaveRegister messages and writes them into an undersized heap allocation, corrupting adjacent heap metadata and objects.
Attack Vector
The attack vector is adjacent network, meaning the attacker must be on the same logical network as the charger, such as the local Wi-Fi or wired segment used for DLB communication. No authentication or user interaction is required. An attacker crafts a malicious DLB_SlaveRegister packet with an oversized payload and sends it to a target charger. Heap corruption can then be steered toward arbitrary code execution, potentially allowing manipulation of charging behavior, lateral movement, or persistent firmware compromise. Refer to the Zero Day Initiative Advisory ZDI-25-349 for additional technical context.
Detection Methods for CVE-2025-5830
Indicators of Compromise
- Unexpected DLB_SlaveRegister messages originating from devices that are not authorized DLB peers on the charger network.
- Charger process crashes, restarts, or watchdog resets correlated with inbound DLB traffic.
- Outbound connections from charger management interfaces to unknown external hosts after receipt of DLB registration messages.
Detection Strategies
- Inspect DLB traffic at the network layer for oversized DLB_SlaveRegister fields exceeding documented protocol lengths.
- Baseline normal DLB peer relationships and alert on new or unauthorized slave registrations.
- Correlate charger firmware crash logs with network packet captures to identify exploitation attempts.
Monitoring Recommendations
- Deploy network sensors on EV charging VLANs to capture and analyze DLB protocol traffic.
- Forward charger syslog and diagnostic events to a centralized log platform for anomaly detection.
- Monitor for unauthorized devices joining the operational technology (OT) segment hosting MaxiCharger units.
How to Mitigate CVE-2025-5830
Immediate Actions Required
- Inventory all Autel MaxiCharger AC and DC units and identify firmware versions in production.
- Isolate charger management networks from corporate, guest, and untrusted wireless segments.
- Restrict DLB communication to an allowlist of known master and slave charger MAC and IP addresses.
- Contact Autel support for firmware updates addressing CVE-2025-5830 and ZDI-25-349.
Patch Information
No public vendor advisory or fixed firmware version is referenced in the NVD record at the time of publication. Operators should contact Autel directly and monitor the Zero Day Initiative Advisory ZDI-25-349 for updates on remediation availability.
Workarounds
- Place chargers on a dedicated VLAN with strict ingress filtering and no exposure to general user networks.
- Disable Dynamic Load Balancing on standalone chargers where peer coordination is not required.
- Apply firewall rules that block unsolicited DLB traffic from devices outside the authorized peer set.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
