CVE-2026-13305 in MaxiCharger AC Elite Home
Summary
by MITRE • 07/29/2026
Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of a user-supplied software update image. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29062.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability represents a critical security flaw in the Autel MaxiCharger AC Elite Home EV charger firmware update mechanism, classified as a cryptographic signature verification failure that enables arbitrary code execution. The vulnerability stems from insufficient validation of software update images during the update process, creating an attack surface where malicious actors can inject unauthorized code into the device's operational environment. The flaw exists specifically within the update handling logic that fails to properly verify the authenticity and integrity of firmware images before installation.
The technical implementation of this vulnerability exploits the absence of robust cryptographic signature validation within the charger's update protocol. When the device receives a software update, it does not adequately verify that the update image originates from a legitimate source or has not been tampered with during transmission. This oversight allows attackers to craft malicious firmware updates that appear legitimate to the device's verification system, enabling successful installation of unauthorized code. The vulnerability operates at the firmware level and affects the device's core operational capabilities, as the update process typically requires elevated privileges within the system.
From an operational perspective, this vulnerability presents a severe risk to both individual users and broader infrastructure security due to its physical presence requirement and lack of authentication barriers. Attackers need only gain physical access to the device to exploit this flaw, making it particularly dangerous in environments where unauthorized personnel might obtain access to charging stations. The absence of authentication requirements means that any individual with physical access can execute code on the device, potentially leading to various malicious outcomes including data exfiltration, device compromise, or disruption of charging services. This vulnerability directly impacts the security posture of electric vehicle charging infrastructure and could enable attackers to escalate privileges or establish persistent access points.
The exploitation of this vulnerability aligns with attack patterns identified in the mitre ATT&CK framework under software supply chain attacks and privilege escalation techniques. The vulnerability maps to CWE-347, which describes improper verification of cryptographic signatures, and represents a failure in the device's integrity checking mechanisms. Organizations should implement immediate mitigations including disabling automatic update functionality where possible, implementing physical security controls to prevent unauthorized access to charging equipment, and conducting thorough inventory assessments of affected devices. The vulnerability also highlights the importance of secure boot processes and cryptographic validation in embedded systems, particularly those serving critical infrastructure functions such as electric vehicle charging stations. Security professionals should monitor for any related vulnerabilities in similar charging equipment and consider implementing network segmentation to limit potential lateral movement if compromise occurs.