CVE-2025-6678

Executive Summary

CVE-2025-6678 is a critical authentication bypass vulnerability in the Autel MaxiCharger AC Wallbox Commercial charging station. The flaw resides in the Pile API, where a lack of authentication allows remote attackers to access sensitive information, including credentials, without any prior authorization. With a CVSS score of 7.5, this vulnerability poses a significant risk to the confidentiality of EV charging infrastructure. The vendor has not released a patch, and no public proof-of-concept (PoC) or exploit code is currently available. This report provides a comprehensive analysis, detection strategies, and mitigation recommendations.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is high due to the ease of exploitation (no authentication required) and the potential for credential disclosure, which could lead to further compromise of the charging station and connected networks.

Deep Dive & Mechanics

The vulnerability exists within the Pile API of the Autel MaxiCharger AC Wallbox Commercial. The Pile API is responsible for managing charging sessions, user data, and device configuration. The flaw is a classic case of missing authentication (CWE-306) – the API endpoints do not verify the identity of the requester before granting access to sensitive functionality.

An attacker can send crafted HTTP requests to the Pile API endpoints (e.g., /api/v1/charger/config, /api/v1/credentials) without any token or session cookie. The server responds with sensitive data, including:

• Wi-Fi credentials
• OCPP (Open Charge Point Protocol) credentials
• User account details
• Device configuration parameters

This information can be used to:

• Gain unauthorized access to the charging station's management interface.
• Pivot to internal networks if the charger is connected to a corporate or home LAN.
• Manipulate charging sessions or disable the charger.

The lack of authentication is likely due to a design oversight where the API was intended for internal use only but was exposed to the network without proper access controls.

Vulnerable vs. Patched Code

Since no patch is available, a comparison is not possible. However, the vulnerable code pattern is:

Vulnerable (Pseudo-code):

@app.route('/api/v1/credentials')
def get_credentials():
    # No authentication check
    return json.dumps(load_credentials())

Patched (Expected):

@app.route('/api/v1/credentials')
@require_auth
def get_credentials():
    return json.dumps(load_credentials())

The require_auth decorator would validate a session token or API key before processing the request.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain an Autel MaxiCharger AC Wallbox Commercial (or use a network simulator).
2. Connect the charger to a local network with a known IP address (e.g., 192.168.1.100).
3. Use a tool like curl or Postman to interact with the Pile API.

Exploitation Steps:

1. Scan the network for the charger's IP.
2. Send a GET request to the credentials endpoint:

   curl -X GET http://192.168.1.100/api/v1/credentials
   

3. If successful, the response will contain sensitive data in JSON format.
4. Extract credentials and use them to access the charger's admin panel or OCPP backend.

Expected Output:

{
  "wifi_ssid": "HomeNetwork",
  "wifi_password": "secret123",
  "ocpp_username": "admin",
  "ocpp_password": "password456"
}

Blue Team

Detection:

• Monitor for unusual HTTP requests to /api/v1/ endpoints from unknown IPs.
• Look for repeated attempts to access credential endpoints without authentication.
• Use network segmentation to isolate charging stations from critical systems.

Honeypot:

• Deploy a fake Autel charger endpoint that logs all incoming requests and alerts on any access to /api/v1/credentials.

Indicators of Compromise (IOCs)

• Network:

  • HTTP GET requests to /api/v1/credentials, /api/v1/config, or similar endpoints.
  • Source IPs not in the authorized management subnet.
  • Unusual outbound connections from the charger to unknown IPs (if credentials are used for further compromise).

• File/System:

  • Unauthorized changes to charger configuration.
  • New user accounts created on the charger's management interface.

• Logs:

  • Missing authentication logs for API access.
  • Repeated 200 OK responses to unauthenticated requests to sensitive endpoints.

Detection Engineering

YARA Rule

rule CVE_2025_6678_Autel_Charger_Exploit {
    meta:
        description = "Detects HTTP requests targeting Autel MaxiCharger Pile API without authentication"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-6678"
    strings:
        $api_path = "/api/v1/credentials" nocase
        $api_path2 = "/api/v1/config" nocase
        $api_path3 = "/api/v1/users" nocase
        $http_get = "GET" nocase
    condition:
        any of ($api_path*) and $http_get
}

Sigma Rule

title: Autel MaxiCharger Pile API Unauthenticated Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated HTTP GET requests to sensitive Autel charger API endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/api/v1/credentials'
            - '/api/v1/config'
            - '/api/v1/users'
    condition: selection
falsepositives:
    - Legitimate management tools if misconfigured
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6678 Autel MaxiCharger Pile API Unauthenticated Access"; flow:to_server; content:"GET"; http_method; content:"/api/v1/credentials"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Since no official patch is available, the following mitigations are recommended:

1. Network Segmentation: Isolate the charging station on a separate VLAN with strict firewall rules. Only allow management traffic from trusted IPs.
2. API Authentication: If possible, implement a reverse proxy (e.g., Nginx) in front of the charger that requires authentication before forwarding requests to the Pile API.
3. Disable Unused Features: If the Pile API is not required, disable it via the charger's configuration interface.
4. Monitor Logs: Enable and monitor all logs from the charger for suspicious activity.
5. Vendor Contact: Pressure Autel for a firmware update that adds authentication to the Pile API.
6. WAF Rules: Deploy a Web Application Firewall (WAF) with rules to block requests to /api/v1/ endpoints from untrusted sources.

Valters IT
Securing the Future of EV Infrastructure