Hardcoded Credentials Bypass Vulnerability in Autel MaxiCharger AC Elite Business C50

CVE-2024-23958

What is CVE-2024-23958?

The Autel MaxiCharger AC Elite Business C50 is affected by a vulnerability that allows network-adjacent attackers to bypass authentication mechanisms. This flaw is rooted in the BLE AppAuthenRequest command handler, which relies on hardcoded credentials as a fallback during authentication failures. As a result, attackers can exploit this weakness to gain unauthorized access to the system, circumventing any intended security measures. Proper mitigation strategies must be employed to address this critical security issue.

References