CVE-2025-5822

Executive Summary

CVE-2025-5822 is a critical privilege escalation vulnerability in the Autel MaxiCharger AC Wallbox Commercial charging station. The flaw resides in the Autel Technician API, where incorrect authorization allows an attacker with a low-privileged token to escalate privileges and access resources normally protected from the user. This vulnerability is particularly dangerous as it can be exploited remotely, potentially allowing an attacker to take full control of the charging station, manipulate charging sessions, or exfiltrate sensitive data. The vendor has not yet released a patch, and no public proof-of-concept (PoC) or exploit code is available at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation (low complexity, no user interaction) and the severe impact on confidentiality, integrity, and availability. An attacker with a low-privileged token can fully compromise the device.

Deep Dive & Mechanics

The vulnerability is rooted in the Autel Technician API, which is used for maintenance and configuration of the charging station. The API fails to properly enforce authorization checks, allowing a user with a low-privileged token to access endpoints that should be restricted to higher-privileged roles (e.g., administrator or technician). This is a classic case of Incorrect Authorization (CWE-863).

The attack flow is as follows:

1. Initial Access: The attacker obtains a low-privileged authorization token. This could be achieved through social engineering, credential stuffing, or by exploiting another vulnerability.
2. API Exploitation: The attacker uses the low-privileged token to make requests to the Autel Technician API endpoints that are meant for privileged users.
3. Privilege Escalation: Due to the lack of proper authorization checks, the API processes the request and returns data or performs actions that should be restricted.
4. Full Compromise: The attacker can then modify charging parameters, disable safety features, or exfiltrate user data.

The vulnerability is particularly concerning because the Autel MaxiCharger is a commercial device, often deployed in public or semi-public locations, making it a high-value target for attackers.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, the vulnerable code likely resembles the following pseudo-code:

Vulnerable Code (Python-like):

@app.route('/api/technician/configure')
def configure_charger():
    token = request.headers.get('Authorization')
    user = verify_token(token)
    # Missing authorization check
    # Any authenticated user can access this endpoint
    return perform_configuration(request.json)

Patched Code (Expected):

@app.route('/api/technician/configure')
@requires_role('admin')  # Enforce role-based access control
def configure_charger():
    token = request.headers.get('Authorization')
    user = verify_token(token)
    if user.role != 'admin':
        abort(403)
    return perform_configuration(request.json)

The fix would involve adding proper authorization checks, such as role-based access control (RBAC) or attribute-based access control (ABAC), to ensure that only users with the appropriate privileges can access sensitive API endpoints.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A low-privileged authorization token for an Autel MaxiCharger.
• Network access to the charging station (typically on the local network or via the cloud API).

Exploitation Steps:

1. Identify API Endpoints: Use a tool like Burp Suite or Postman to enumerate the Autel Technician API endpoints. Look for endpoints that perform privileged actions (e.g., /api/technician/configure, /api/technician/firmware-update).
2. Craft Request: Using the low-privileged token, send a request to a privileged endpoint.

   curl -X POST https://<charger-ip>/api/technician/configure \
     -H "Authorization: Bearer <low-privilege-token>" \
     -H "Content-Type: application/json" \
     -d '{"param": "value"}'
   

3. Verify Escalation: If the request succeeds (e.g., returns a 200 OK and modifies the configuration), the vulnerability is confirmed.
4. Escalate Further: Use the escalated privileges to perform actions like disabling charging, changing pricing, or exfiltrating user data.

No public exploit code is available for this CVE.

Blue Team (Detection & Defense)

Detection:

• Monitor API logs for unauthorized access to privileged endpoints.
• Look for requests from low-privileged tokens to endpoints like /api/technician/*.
• Alert on any configuration changes made outside of normal maintenance windows.

Defense:

• Implement network segmentation to isolate charging stations from untrusted networks.
• Use a Web Application Firewall (WAF) to block suspicious API requests.
• Enforce strict role-based access control on the API.
• Regularly audit authorization tokens and revoke any that are not needed.

Indicators of Compromise (IOCs)

• Network Indicators:
  • Unusual API requests to /api/technician/* endpoints from low-privileged tokens.
  • Anomalous configuration changes on the charging station.
• Host Indicators:
  • Unexpected changes to charging parameters (e.g., pricing, power limits).
  • Unauthorized firmware updates.
• Log Indicators:
  • API logs showing successful requests to privileged endpoints from non-admin users.
  • Repeated failed authorization attempts followed by a successful request.

Detection Engineering

YARA Rule

rule CVE_2025_5822_Autel_PrivEsc {
    meta:
        description = "Detects exploitation attempts of CVE-2025-5822 in Autel MaxiCharger API logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-5822"
    strings:
        $api_endpoint = "/api/technician/" ascii wide nocase
        $auth_header = "Authorization: Bearer" ascii wide nocase
        $low_priv_token = "token_type=user" ascii wide nocase  // Example pattern
    condition:
        $api_endpoint and $auth_header and $low_priv_token
}

Sigma Rule

title: Autel MaxiCharger Privilege Escalation via Technician API
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-5822 by accessing privileged API endpoints with a low-privileged token.
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: autel_maxicharger
detection:
    selection:
        http.url|contains: "/api/technician/"
        http.method: "POST"
        http.response.status_code: 200
    condition: selection
falsepositives:
    - Legitimate technician activity during maintenance
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-5822 - Autel MaxiCharger Privilege Escalation Attempt";
    flow:to_server,established;
    content:"/api/technician/"; http_uri;
    content:"Authorization|3a| Bearer"; http_header;
    pcre:"/token_type=user/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-5822;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate Charging Stations: Place Autel MaxiCharger devices on a separate VLAN with strict firewall rules to limit network access.
2. Monitor API Logs: Enable detailed logging for the Technician API and monitor for suspicious activity.
3. Revoke Unnecessary Tokens: Audit all authorization tokens and revoke any that are not required.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from Autel that implements proper authorization checks.
• Workaround: If possible, disable the Technician API or restrict it to specific IP addresses using a firewall.
• Compensating Controls: Implement a Web Application Firewall (WAF) or API gateway to enforce access control policies.

Valters IT
Securing the Future of EV Infrastructure