CVE-2025-5830

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of DLB_SlaveRegister messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26327.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-583005.5Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability.CVE-2025-583015.5Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability.CVE-2025-583025.5Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiCVE-2025-583035.5UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-583045.5Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect service conCVE-2025-583055.5Identity authentication bypass vulnerability in the Gallery app. Impact: Successful exploitation of this vulnerability may affect service coCVE-2025-583075.5UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-583083.3Vulnerability of improper criterion security check in the call module. Impact: Successful exploitation of this vulnerability may cause featuCVE-2025-583097.1Permission control vulnerability in the startup recovery module. Impact: Successful exploitation of this vulnerability will affect availabilCVE-2025-58318.8The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline()CVE-2025-583105.5Permission control vulnerability in the distributed component. Impact: Successful exploitation of this vulnerability may affect service confCVE-2025-583117.1UAF vulnerability in the USB driver module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiali
CVE-2025-5830: High severity, CVSS 8.8 | Vulnix