Cyber Resilience

CVE-2025-5826

Autel Maxicharger Ac Elite Business C50 Firmware ≤ 1.39.51

Published
25 June 2025
Modified
17 June 2026
CVSS Score v3 6.3
Click a component to see what it means
Raw vectorCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0023 14th percentile
Risk Priority 47 floored blend · peak EPSS

Summary

CVE-2025-5826 is a medium-severity Misinterpretation of Input (CWE-115) vulnerability in Autel Maxicharger Ac Elite Business C50 Firmware. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability Data

Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability. The…

more

specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368.

CWE(s)
CWE-115

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1204 User Execution Execution
An adversary may rely upon specific actions by a user in order to gain execution.
attack.mitre.org →
T1221 Template Injection Stealth
Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.
attack.mitre.org →
T1659 Content Injection Initial Access
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-5823Same product: Autel Maxicharger Ac Elite Business C50
CVE-2025-6678Same product: Autel Maxicharger Ac Elite Business C50
CVE-2025-5829Same product: Autel Maxicharger Ac Elite Business C50
CVE-2025-5830Same product: Autel Maxicharger Ac Elite Business C50
CVE-2025-5827Same product: Autel Maxicharger Ac Elite Business C50
CVE-2025-5828Same product: Autel Maxicharger Ac Elite Business C50
CVE-2025-5824Same product: Autel Maxicharger Ac Elite Business C50
CVE-2025-5822Same product: Autel Maxicharger Ac Elite Business C50
CVE-2025-5825Same product: Autel Maxicharger Ac Elite Business C50
CVE-2025-54584Shared CWE-115

Affected Assets

autel
maxicharger ac elite business c50 firmware
≤ 1.39.51 · ≤ 1.56.51
autel
maxicharger ac pro firmware
≤ 1.39.51 · ≤ 1.56.51
autel
maxicharger ac ultra firmware
≤ 1.39.51 · ≤ 1.56.51
autel
maxicharger dc compact mobile firmware
≤ 1.39.51 · ≤ 1.56.51
autel
maxicharger dc compact pedestal firmware
≤ 1.39.51 · ≤ 1.56.51
autel
maxicharger dc fast firmware
≤ 1.39.51 · ≤ 1.56.51
autel
maxicharger dc hipower firmware
≤ 1.39.51 · ≤ 1.56.51
autel
maxicharger dh480 firmware
≤ 1.39.51 · ≤ 1.56.51
autel
maxicharger single charger firmware
≤ 1.39.51 · ≤ 1.56.51

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match

Input validation directly stops the system from accepting and acting on misinterpreted data values.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require correct input parsing/validation to avoid misinterpretation flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect input misinterpretation flaws but does not itself implement the preventive controls.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle mandates input validation and canonicalization that directly prevent misinterpretation of inputs.

A.8.26 Application security requirements partial match
prevents

Application security requirements explicitly call for robust input handling and sanitization to avoid misinterpretation.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles include defensive input processing and error handling that reduce misinterpretation risks.

A.8.28 Secure coding partial match
prevents

Secure coding standards require strict input validation and canonical forms to eliminate misinterpretation vulnerabilities.

References