Autel MaxiCharger AC Wallbox Commercial Stack-Based Buffer Overflow Remote Code Execution Vulnerability

A stack-based buffer overflow vulnerability allowing remote code execution has been identified in the Autel MaxiCharger AC Wallbox Commercial EV chargers. This issue arises in the ble_process_esp32_msg function, where user-supplied data is not properly validated before being copied to a fixed-length stack-based buffer. As a result, network-adjacent attackers can execute arbitrary code on the affected devices without requiring authentication.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected EV chargers, with the executed code running in the context of the device.

Remediation

The vulnerability has been fixed in the American Standard version 1.39.51 and European Standard version 1.56.51.