CVE-2026-13309
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A stack-based buffer overflow vulnerability in the Autel MaxiCharger AC Elite Home charger allows a physically present attacker to execute arbitrary code via a crafted NFC card response. Authentication is not required for exploitation.
Risk Assessment
An attacker could gain full control of the device, potentially leading to manipulation of the charging process or data theft.
Recommendation
Update the charger firmware to the latest version provided by the manufacturer and restrict physical access to the device.
Other vulnerabilities in Autel MaxiCharger AC Elite Home
See all- CVE-2026-13308High
Autel MaxiCharger AC Elite Home EV chargers have an integer underflow vulnerability in WebSocket OCPP message handling, allowing an unauthenticated remote attacker to execute arbitrary code on the device.
- CVE-2026-13307Medium
A heap-based buffer overflow vulnerability in the Autel MaxiCharger AC Elite Home charger allows a physically present attacker to execute arbitrary code via crafted USB packets. Authentication is not required.
- CVE-2026-13306Medium
An authentication bypass vulnerability in the Autel MaxiCharger AC Elite Home charger via the USB interface allows a physically present attacker to access device functions without authentication. No authentication is required.
- CVE-2026-13305Medium
A vulnerability in the software update process of the Autel MaxiCharger AC Elite Home charger allows a physically present attacker to execute arbitrary code by supplying a improperly verified update image. Authentication is not required.
Original NVD description (English source)
Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of card responses via the NFC interface. A crafted card response can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29044.