MaxiCharger AC Elite Business C50 Buffet Overflow Vulnerability

CVE-2024-23967

What is CVE-2024-23967?

The Autel MaxiCharger AC Elite Business C50 is vulnerable to a stack-based buffer overflow due to improper validation of base64-encoded data in WebSocket messages. Network-adjacent attackers can exploit this vulnerability to execute arbitrary code on the device. Despite requiring authentication, the vulnerability allows an attacker to bypass the existing authentication mechanism, potentially leading to unauthorized control over the affected installations. This flaw emphasizes the necessity for robust input validation in networked environments to mitigate risks of remote exploitation.

References