CVE-2026-13308
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Autel MaxiCharger AC Elite Home EV chargers have an integer underflow vulnerability in WebSocket OCPP message handling, allowing an unauthenticated remote attacker to execute arbitrary code on the device.
Risk Assessment
An attacker can gain full control of the charger, potentially disrupting its operation or using it for further attacks.
Recommendation
Contact the manufacturer for a firmware update for the charger.
Other vulnerabilities in Autel MaxiCharger AC Elite Home
See all- CVE-2026-13309Medium
A stack-based buffer overflow vulnerability in the Autel MaxiCharger AC Elite Home charger allows a physically present attacker to execute arbitrary code via a crafted NFC card response. Authentication is not required for exploitation.
- CVE-2026-13307Medium
A heap-based buffer overflow vulnerability in the Autel MaxiCharger AC Elite Home charger allows a physically present attacker to execute arbitrary code via crafted USB packets. Authentication is not required.
- CVE-2026-13306Medium
An authentication bypass vulnerability in the Autel MaxiCharger AC Elite Home charger via the USB interface allows a physically present attacker to access device functions without authentication. No authentication is required.
- CVE-2026-13305Medium
A vulnerability in the software update process of the Autel MaxiCharger AC Elite Home charger allows a physically present attacker to execute arbitrary code by supplying a improperly verified update image. Authentication is not required.
Original NVD description (English source)
Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of WebSocket messages related to the OCPP service. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29113.