CVE-2026-13306
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
An authentication bypass vulnerability in the Autel MaxiCharger AC Elite Home charger via the USB interface allows a physically present attacker to access device functions without authentication. No authentication is required.
Risk Assessment
An attacker could gain unauthorized access to charger settings and functions, potentially leading to unsafe configurations or energy theft.
Recommendation
Update the charger firmware and implement additional physical security measures, such as locking the USB port.
Other vulnerabilities in Autel MaxiCharger AC Elite Home
See all- CVE-2026-13309Medium
A stack-based buffer overflow vulnerability in the Autel MaxiCharger AC Elite Home charger allows a physically present attacker to execute arbitrary code via a crafted NFC card response. Authentication is not required for exploitation.
- CVE-2026-13308High
Autel MaxiCharger AC Elite Home EV chargers have an integer underflow vulnerability in WebSocket OCPP message handling, allowing an unauthenticated remote attacker to execute arbitrary code on the device.
- CVE-2026-13307Medium
A heap-based buffer overflow vulnerability in the Autel MaxiCharger AC Elite Home charger allows a physically present attacker to execute arbitrary code via crafted USB packets. Authentication is not required.
- CVE-2026-13305Medium
A vulnerability in the software update process of the Autel MaxiCharger AC Elite Home charger allows a physically present attacker to execute arbitrary code by supplying a improperly verified update image. Authentication is not required.
Original NVD description (English source)
Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the exposed USB interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29046.