CVE-2025-5827

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the ble_process_esp32_msg function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26369.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-582707.1Cross-Site Request Forgery (CSRF) vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Cross Site Request ForgeCVE-2025-582715.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AnyClip Video Platform AnyClip LuminouCVE-2025-582722.0Cross-site request forgery vulnerability exists in Web Caster V130 versions 1.08 and earlier. If a logged-in user views a malicious page creCVE-2025-582765.5Permission verification vulnerability in the home screen module Impact: Successful exploitation of this vulnerability may affect availabilitCVE-2025-582775.5Permission verification bypass vulnerability in the Camera app. Successful exploitation of this vulnerability may affect service confidentiaCVE-2025-582785.5Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiCVE-2025-582795.5Permission control vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confiCVE-2025-58286.8Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically prCVE-2025-582805.5Vulnerability of exposing object heap addresses in the Ark eTS module. Impact: Successful exploitation of this vulnerability may affect avaiCVE-2025-582815.5Out-of-bounds read vulnerability in the runtime interpreter module. Impact: Successful exploitation of this vulnerability may affect availabCVE-2025-582825.5Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality.CVE-2025-582835.5Permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-5827: High severity, CVSS 8.8 | Vulnix