CVE-2025-5826

Executive Summary

CVE-2025-5826 is a critical vulnerability in the Autel MaxiCharger AC Wallbox Commercial charging station. The flaw resides in the ble_process_esp32_msg function, which mishandles input data, allowing network-adjacent attackers to inject arbitrary AT commands without authentication. This can lead to unauthorized control of the device, potentially disrupting charging operations or enabling further network compromise. The vulnerability has a CVSS score of 6.3 (Medium), but its impact is amplified by the lack of authentication requirements and the device's role in critical infrastructure. No public proof-of-concept (PoC) or exploit code is available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a proprietary embedded system (ESP32-based). No supply chain package security concerns apply.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Adjacent Network (AV:A) – attacker must be on the same local network or within Bluetooth range.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited modification of device state.
• Availability Impact: Low (A:L) – limited disruption of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of authentication and potential for lateral movement in EV charging infrastructure elevates the risk.

Deep Dive & Mechanics

The vulnerability is in the ble_process_esp32_msg function of the Autel MaxiCharger firmware. This function processes incoming Bluetooth Low Energy (BLE) messages from the ESP32 module. The flaw is a "Misinterpretation of Input" (CWE-436), meaning the software incorrectly interprets a message, leading to unintended behavior.

Technical Details:

• The function likely parses BLE packets to extract AT commands for device configuration or diagnostics.
• Due to improper input validation or parsing logic, an attacker can craft a BLE message that is interpreted as a valid AT command, even though it contains malicious payload.
• The ESP32 module then executes these AT commands, which can include operations like rebooting, changing settings, or sending data to external servers.
• The attack is network-adjacent, meaning the attacker must be within BLE range (typically up to 100 meters) or on the same Wi-Fi network if the BLE is bridged.

Attack Scenario:

1. Attacker scans for BLE devices and identifies an Autel MaxiCharger.
2. Attacker sends a crafted BLE packet to the device.
3. The ble_process_esp32_msg function misinterprets the packet and executes the embedded AT command.
4. The attacker can then control the charger, e.g., disable charging, change power levels, or exfiltrate data.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve:

• Vulnerable Code: The ble_process_esp32_msg function directly passes BLE message content to an AT command parser without sanitization.

  void ble_process_esp32_msg(uint8_t *msg, int len) {
      // Directly interpret msg as AT command
      execute_at_command((char*)msg);
  }
  

• Patched Code: Input validation and whitelisting of allowed commands.

  void ble_process_esp32_msg(uint8_t *msg, int len) {
      // Validate message format and content
      if (is_valid_at_command(msg, len)) {
          execute_at_command((char*)msg);
      } else {
          log_error("Invalid BLE message");
      }
  }
  

  The is_valid_at_command function would check for allowed command prefixes and reject unexpected characters.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Bluetooth adapter (e.g., USB BLE dongle) on a Linux machine.
• Tools: hcitool, gatttool, or custom Python script using bluepy or pygatt.
• Target: Autel MaxiCharger AC Wallbox Commercial within BLE range.

Steps:

1. Discover BLE devices:

   sudo hcitool lescan
   

   Look for the Autel charger's BLE advertisement.

2. Connect to the device:

   sudo gatttool -b <MAC_ADDRESS> -I
   connect
   

3. Craft malicious BLE message: The exact payload depends on the AT command set. Example: AT+RESET to reboot.

   import pygatt
   adapter = pygatt.GATTToolBackend()
   adapter.start()
   device = adapter.connect('<MAC_ADDRESS>')
   # Send crafted message to the characteristic that triggers ble_process_esp32_msg
   device.char_write('0000xxxx-0000-1000-8000-00805f9b34fb', b'AT+RESET')
   

4. Observe behavior: The charger may reboot or change state.

Note: No public exploit code is available. This is a theoretical approach.

Blue Team (Defense & Detection)

Defensive Measures:

• Network Segmentation: Isolate EV chargers on a separate VLAN with strict firewall rules.
• BLE Monitoring: Use BLE sniffers (e.g., Wireshark with BLE dongle) to detect anomalous packets.
• Firmware Hardening: Disable unnecessary BLE services or require authentication for AT commands.
• Intrusion Detection: Deploy IDS rules to detect BLE-based attacks (see Detection Engineering).

Detection Steps:

1. Monitor BLE traffic for unusual command patterns.
2. Log all AT command executions on the charger (if supported).
3. Alert on multiple failed connection attempts or unexpected reboots.

Indicators of Compromise (IOCs)

• Network IOCs:

  • BLE packets with unusual AT command strings (e.g., AT+, AT#, AT*).
  • Repeated BLE connection attempts from unknown MAC addresses.
  • Unusual device behavior (e.g., unexpected reboots, configuration changes).

• Host IOCs:

  • Logs showing execution of AT commands not initiated by legitimate users.
  • Changes to charger settings (e.g., power limits, network config).

• File IOCs:

  • Modified firmware files (if attacker gains deeper access).

Detection Engineering

YARA Rule

rule CVE_2025_5826_Autel_BLE_AT_Command_Injection {
    meta:
        description = "Detects BLE packets containing AT command injection attempts targeting Autel MaxiCharger"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-5826"
    strings:
        $at_cmd = /AT\+[A-Z]+/  // Matches AT+COMMAND patterns
        $ble_header = { 00 00 00 00 }  // Example BLE header (adjust based on actual protocol)
    condition:
        $at_cmd and $ble_header
}

Sigma Rule

title: Autel MaxiCharger BLE AT Command Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects BLE packets with AT command patterns targeting Autel chargers
author: Valters IT
logsource:
    category: network
    product: bluetooth
detection:
    selection:
        payload|contains: 'AT+'
    condition: selection
falsepositives:
    - Legitimate AT commands from authorized tools
level: medium

Suricata Rule

alert bluetooth any any -> any any (msg:"CVE-2025-5826 Autel MaxiCharger BLE AT Command Injection"; content:"AT+"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable BLE if not required: Turn off Bluetooth on the charger via physical switch or firmware settings.
2. Network Isolation: Place chargers on a separate VLAN with no internet access.
3. Monitor BLE Traffic: Use BLE sniffers to detect anomalies.

Long-Term Fixes:

• Vendor Patch: Await an official firmware update from Autel that fixes the input validation in ble_process_esp32_msg.
• Firmware Hardening: Implement authentication for all AT commands.
• Regular Audits: Conduct security assessments of EV charging infrastructure.

Workarounds:

• Use physical access controls to prevent attackers from being within BLE range.
• Implement a BLE firewall that filters out suspicious packets.

Valters IT