Stack-Based Buffer Overflow Vulnerability in Autel MaxiCharger AC Elite Business C50
CVE-2024-7795

8.8HIGH

Key Information:

Vendor

Autel

Status
Maxicharger Ac Elite Business C50 Firmware
Vendor
CVE Published:
21 August 2024

What is CVE-2024-7795?

A vulnerability exists in the Autel MaxiCharger AC Elite Business C50 due to improper handling of the AppAuthenExchangeRandomNum Bluetooth Low Energy command. This flaw allows network-adjacent attackers to execute arbitrary code without requiring authentication. The vulnerability arises from insufficient validation of the length of data provided by users before it is copied to a fixed-length stack-based buffer, enabling potential exploitation that could compromise the device's integrity.

References

https://www.zerodayinitiative.com/advisories/ZDI-24-1154/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.