CVE-2025-5823

Executive Summary

CVE-2025-5823 is an information disclosure vulnerability in the Autel MaxiCharger AC Wallbox Commercial EV charger. The flaw resides in the Autel Technician API, where an exposed dangerous method allows authenticated remote attackers to retrieve sensitive information, including credentials. With a CVSS score of 4.9 (Medium), the vulnerability requires authentication but can lead to further compromise of the EV charging infrastructure. No public exploit code or patch is currently available, making this a high-priority monitoring and hardening issue for asset owners.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (credentials exposed)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the direct impact is limited to credential disclosure, the potential for lateral movement and compromise of other systems elevates the risk.

Deep Dive & Mechanics

The vulnerability exists in the Autel Technician API, a backend service used for maintenance and configuration of the MaxiCharger AC Wallbox Commercial. The API exposes a dangerous method that, when invoked by an authenticated user, returns sensitive data such as device credentials, API keys, or session tokens. This is a classic CWE-749 (Exposed Dangerous Method or Function) issue, where the API endpoint lacks proper access controls or input validation to restrict access to privileged operations.

Attack Flow:

1. Attacker obtains valid authentication credentials (e.g., via phishing, default credentials, or previous compromise).
2. Attacker sends a crafted request to the vulnerable API endpoint (e.g., /api/technician/getCredentials or similar).
3. The server responds with plaintext credentials or tokens.
4. Attacker uses these credentials to access other parts of the charger’s management interface or the broader network.

The vulnerability is particularly dangerous because the charger is often deployed in commercial environments (e.g., parking lots, fleet depots) and may be connected to corporate networks. Credential disclosure could enable attackers to pivot to internal systems.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely resembles:

# Vulnerable API endpoint (pseudocode)
@app.route('/api/technician/getCredentials', methods=['POST'])
def get_credentials():
    # No authorization check beyond basic authentication
    user = authenticate(request)
    if user:
        # Returns all stored credentials without filtering
        return jsonify(credentials_db.get_all())
    else:
        return "Unauthorized", 401

A patched version would require:

• Role-based access control (e.g., only admin users can access this endpoint).
• Input validation to ensure the request is legitimate.
• Encryption of credentials at rest and in transit.
• Logging and monitoring of access to sensitive endpoints.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for the Autel Technician API (e.g., username/password or API token).
• Network access to the charger’s management interface (typically on port 443 or 8080).

Exploitation Steps:

1. Authenticate to the API:

   curl -X POST https://<charger-ip>/api/login -d '{"username":"admin","password":"password123"}'
   

2. Extract session token from response.
3. Call the vulnerable endpoint:

   curl -X POST https://<charger-ip>/api/technician/getCredentials -H "Authorization: Bearer <token>"
   

4. Parse the JSON response to extract credentials.

Lab Setup:

• Use a virtualized Autel MaxiCharger firmware (if available) or a network simulator.
• Alternatively, set up a mock API server using Flask or Node.js to replicate the vulnerable behavior.

Blue Team

Detection:

• Monitor for repeated authentication attempts to the /api/technician/getCredentials endpoint.
• Alert on unusual access patterns (e.g., from non-admin accounts).
• Use network segmentation to isolate EV chargers from critical systems.

Hunting:

• Search logs for getCredentials or similar endpoint calls.
• Correlate with failed login attempts to identify brute-force attacks.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /api/technician/getCredentials or similar paths.
  • Unusual outbound connections from the charger to external IPs (e.g., data exfiltration).
• File:
  • Presence of credential dumps in /tmp/ or /var/log/ on the charger.
• Behavioral:
  • Multiple successful authentications from different IPs in a short time.
  • API responses containing plaintext credentials.

Detection Engineering

YARA Rule

rule CVE_2025_5823_Autel_Credential_Disclosure {
    meta:
        description = "Detects credential disclosure attempts via Autel Technician API"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5823"
    strings:
        $endpoint = "/api/technician/getCredentials" ascii wide nocase
        $cred_pattern = /"password"\s*:\s*"[^"]+"/ ascii wide
        $token_pattern = /"token"\s*:\s*"[^"]+"/ ascii wide
    condition:
        $endpoint and ($cred_pattern or $token_pattern)
}

Sigma Rule

title: Autel MaxiCharger Credential Disclosure Attempt
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit CVE-2025-5823 by accessing the vulnerable API endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/technician/getCredentials'
    condition: selection
falsepositives:
    - Legitimate admin maintenance activities
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-5823 Autel MaxiCharger Credential Disclosure Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/technician/getCredentials"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Place EV chargers on a separate VLAN with strict firewall rules. Only allow management traffic from trusted IPs.
2. Change Default Credentials: Ensure all chargers use strong, unique passwords.
3. Monitor API Logs: Enable logging on the charger’s web server and monitor for suspicious access to the Technician API.

Long-Term Fixes:

• Vendor Patch: Await an official firmware update from Autel that removes or secures the dangerous method.
• API Hardening: Implement role-based access control (RBAC) and require multi-factor authentication (MFA) for sensitive API endpoints.
• Credential Encryption: Store credentials using strong encryption (e.g., AES-256) and never expose them in API responses.

Workaround:

• Disable the Technician API if not required, or block access to it via a reverse proxy or WAF rule.

Valters IT