CVE-2026-13305
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in the software update process of the Autel MaxiCharger AC Elite Home charger allows a physically present attacker to execute arbitrary code by supplying a improperly verified update image. Authentication is not required.
Risk Assessment
An attacker could install malicious firmware on the device, potentially leading to permanent takeover of the charger.
Recommendation
Update the charger firmware to a version that includes a fix for cryptographic signature verification of updates.
Other vulnerabilities in Autel MaxiCharger AC Elite Home
See all- CVE-2026-13309Medium
A stack-based buffer overflow vulnerability in the Autel MaxiCharger AC Elite Home charger allows a physically present attacker to execute arbitrary code via a crafted NFC card response. Authentication is not required for exploitation.
- CVE-2026-13308High
Autel MaxiCharger AC Elite Home EV chargers have an integer underflow vulnerability in WebSocket OCPP message handling, allowing an unauthenticated remote attacker to execute arbitrary code on the device.
- CVE-2026-13307Medium
A heap-based buffer overflow vulnerability in the Autel MaxiCharger AC Elite Home charger allows a physically present attacker to execute arbitrary code via crafted USB packets. Authentication is not required.
- CVE-2026-13306Medium
An authentication bypass vulnerability in the Autel MaxiCharger AC Elite Home charger via the USB interface allows a physically present attacker to access device functions without authentication. No authentication is required.
Original NVD description (English source)
Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of a user-supplied software update image. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29062.