Autel MaxiCharger AC Wallbox Commercial Input Misinterpretation Vulnerability Allowing AT Command Injection

A vulnerability exists in the Autel MaxiCharger AC Wallbox Commercial charging stations, allowing network-adjacent attackers to inject arbitrary AT commands. This issue arises from a misinterpretation of input data in the ble_process_esp32_msg function, enabling command execution in the context of the device. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for unauthorized injection and execution of AT commands on the affected charging stations.

Remediation

Users can update to American Standard V1.39.51 or European Standard V1.56.51 to address this vulnerability.