Overview

We are addressing a severe security vulnerability, CVE-2025-41682, that has been identified in charge controller systems. This vulnerability could be exploited by an authenticated, low-privileged attacker to gain access to stored credentials, including the manufacturer password. Given the critical role that charge controllers play in managing the charging and discharging of batteries in various power systems, an exploit could lead to significant disruptions and potential compromise of the entire system.
The severity of this vulnerability, as indicated by a CVSS score of 8.8 (out of 10), underscores the potential risks it presents. The ability of an attacker to obtain sensitive credentials could lead to unauthorized system access, data leakage, and potential system compromise. It is essential for organizations using affected charge controller systems to understand the nature of this vulnerability and take immediate steps to mitigate it.

Vulnerability Summary

CVE ID: CVE-2025-41682
Severity: Critical (CVSS 8.8)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: System compromise, data leakage

Affected Products

Product | Affected Versions

Charge Controller X1 | All versions prior to 1.3.5
Charge Controller X2 | All versions prior to 2.1.2

How the Exploit Works

The exploit leverages a design flaw in the charge controller’s authentication mechanism. Once an attacker gains low-level access to the system, they can manipulate certain parameters in the authenticated session to retrieve stored credentials. These credentials include the manufacturer password, which grants high-level access to system controls and sensitive data.

Conceptual Example Code

Below is a conceptual example of how an HTTP request might be manipulated to exploit this vulnerability:

GET /api/v1/credentials HTTP/1.1
Host: target.example.com
Authorization: Bearer low-privileged-token
{
"request": "retrieve",
"params": {
"type": "manufacturer"
}
}

In this example, the attacker uses a low-privileged token to request the manufacturer’s credentials. This should not be possible under normal circumstances, but due to the vulnerability, the system fails to properly validate the privilege level of the request.
This is a conceptual example and the actual exploit may involve additional steps or different parameters depending on the specific implementation of the charge controller and its API.