CVE-2025-5824

Executive Summary

CVE-2025-5824 is an authentication bypass vulnerability in the Autel MaxiCharger AC Wallbox Commercial, a networked electric vehicle (EV) charging station. The flaw resides in the Bluetooth pairing mechanism, where the device fails to validate the origin of commands after a successful Bluetooth pairing. An attacker who can physically pair a malicious Bluetooth device (e.g., a smartphone or custom dongle) with the charger can then send arbitrary commands without further authentication, effectively bypassing all security controls. This allows unauthorized control over charging sessions, power management, and potentially firmware operations.

The vulnerability is classified as CWE-346 (Origin Validation Error) and carries a CVSS score of 5.0 (Medium). The attack vector is network-adjacent (Bluetooth range), requires user interaction (pairing), and can lead to high confidentiality and integrity impacts. No public exploit code or proof-of-concept is available, but the technical details from ZDI (ZDI-CAN-26353) confirm the root cause.

Note: This is not a WordPress plugin or component; it is a standalone IoT/OT device. No Apache or Nginx involvement.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Threat Level: Medium (5.0) – requires physical proximity and user interaction, but impact is severe.

Deep Dive & Mechanics

The Autel MaxiCharger AC Wallbox Commercial uses Bluetooth Low Energy (BLE) for initial setup and maintenance. The device implements a pairing process that, once completed, grants the paired device a trusted status. The vulnerability lies in the origin validation of subsequent commands: after pairing, the charger does not verify whether the command source is the same device that completed the pairing. An attacker can:

1. Pair a malicious device (e.g., a smartphone running a custom BLE app) with the charger by exploiting the default pairing mode or social engineering the user.
2. Send arbitrary GATT commands to the charger, including:
   • Start/stop charging sessions
   • Modify charging current limits
   • Read sensitive configuration data (e.g., Wi-Fi credentials, OCPP server details)
   • Trigger firmware update procedures (potentially leading to persistent compromise)

The root cause is insufficient validation of the origin of commands – the device should enforce that only the originally paired device can send authenticated commands, but it fails to do so.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code is in the BLE GATT server implementation. A hypothetical fix would involve:

Vulnerable (pseudocode):

void handle_ble_command(uint8_t *data, uint16_t len) {
    // No origin check – any paired device can send commands
    if (is_paired(conn_handle)) {
        process_command(data, len);
    }
}

Patched (pseudocode):

void handle_ble_command(uint8_t *data, uint16_t len, uint16_t conn_handle) {
    // Verify that the command originates from the same device that paired
    if (is_paired(conn_handle) && is_original_pairing_device(conn_handle)) {
        process_command(data, len);
    } else {
        reject_command();
    }
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A Bluetooth-capable device (e.g., Raspberry Pi with Bluetooth adapter, or smartphone with BLE app)
• Physical proximity to the charger (within ~10 meters)
• Ability to initiate Bluetooth pairing (e.g., by pressing the pairing button on the charger or exploiting default pairing mode)

Steps:

1. Scan for BLE devices: Use hcitool lescan or a BLE scanner app to discover the charger.
2. Pair with the charger: Initiate pairing using standard BLE pairing (e.g., bluetoothctl pair <MAC>). If the charger is in pairing mode, this succeeds.
3. Enumerate GATT services: Use gatttool or a BLE client to list services and characteristics.
4. Send malicious commands: Write to the characteristic that controls charging (e.g., char-write-req <handle> <value>). For example, to stop charging:

   gatttool -b <MAC> --char-write-req -a 0x002e -n 00
   

5. Exfiltrate data: Read sensitive characteristics (e.g., Wi-Fi SSID/password):

   gatttool -b <MAC> --char-read -a 0x0030
   

Lab Setup:

• Use a virtual machine with Bluetooth passthrough (e.g., Kali Linux on VMware with USB Bluetooth dongle).
• Simulate the charger using a BLE peripheral emulator (e.g., nRF Connect on Android) that mimics the vulnerable GATT profile.

Blue Team (Defender)

Detection:

• Monitor for unexpected BLE pairing events on the charger’s network.
• Use a BLE sniffer (e.g., Wireshark with BLE capture) to detect anomalous GATT commands.
• Implement network segmentation: isolate the charger on a separate VLAN with strict firewall rules.

Mitigation:

• Disable Bluetooth if not required.
• Enforce strong pairing (e.g., passkey entry) and limit pairing window.
• Monitor logs for unauthorized command sequences.

Indicators of Compromise (IOCs)

• Network: BLE advertising packets from unknown devices near the charger.
• Device: Unexpected changes in charging schedules or power levels.
• Logs: Repeated failed pairing attempts followed by successful pairing from a new MAC address.
• Firmware: Unauthorized firmware update requests (if logged).

Example IOC (BLE MAC address):

00:11:22:33:44:55 (attacker’s device)

Detection Engineering

YARA Rule

rule CVE_2025_5824_BLE_Exploit {
    meta:
        description = "Detects BLE commands targeting Autel MaxiCharger AC Wallbox"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5824"
    strings:
        $cmd_stop = { 00 01 02 03 }  // Example command bytes
        $cmd_start = { 04 05 06 07 }
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-5824 BLE Authentication Bypass
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects anomalous BLE commands to Autel MaxiCharger
logsource:
    product: linux
    service: bluetooth
detection:
    selection:
        EventID: 1001  # Example BLE event ID
        Data: "char-write-req"
    condition: selection
falsepositives:
    - Legitimate maintenance
level: high

Suricata Rule

alert tcp any any -> any 22 (msg:"CVE-2025-5824 BLE Exploit Attempt"; flow:to_server; content:"|00 01 02 03|"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Vendor Action: Autel must release a firmware update that enforces origin validation for all BLE commands.
2. Workaround: Disable Bluetooth pairing on the charger if not needed. Use wired Ethernet for management.
3. Network Controls: Place the charger on a separate VLAN with strict ACLs. Monitor BLE traffic with a dedicated sensor.
4. User Awareness: Train users to only pair trusted devices and to reset pairing if suspicious activity is detected.
5. Physical Security: Restrict physical access to the charger to prevent unauthorized pairing.

Valters IT
DevSecOps & Cyber Threat Intelligence