Autel MaxiCharger AC Elite Business C50 Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2024-23957

What is CVE-2024-23957?

A significant vulnerability exists within the DLB_HostHeartBeat handler of the DLB protocol in Autel MaxiCharger AC Elite Business C50 charging stations. This flaw enables network-adjacent attackers to execute arbitrary code by exploiting improper validation of user-supplied data when parsing an AES key. The vulnerability allows malicious entities to manipulate the fixed-length stack-based buffer, leading to unauthorized control over the devices. As authentication is not required for exploitation, this vulnerability poses a substantial risk to affected installations.

References