CVE-2026-13306 in MaxiCharger AC Elite Home
Summary
by MITRE • 07/30/2026
Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the exposed USB interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29046.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/30/2026
The Autel MaxiCharger AC Elite Home EV charger represents a critical security vulnerability through its exposed USB interface that permits unauthorized physical access without authentication requirements. This authentication bypass flaw fundamentally undermines the security posture of electric vehicle charging infrastructure by allowing any attacker with physical presence to gain unrestricted access to system functionality. The vulnerability stems from insufficient authorization mechanisms within the device's USB communication protocol, creating an attack surface that directly contradicts established security principles for connected industrial and consumer devices. The absence of proper authentication checks prior to granting access to charging system controls creates a fundamental weakness that can be exploited by adversaries who are physically present at the charging location.
The technical implementation of this vulnerability resides within the USB interface design where no credential verification occurs before permitting access to underlying system functions. This type of flaw aligns with CWE-287, which specifically addresses improper authentication issues in software systems, and represents a classic case of weak session management where authentication tokens or credentials are either absent or improperly validated. The USB port serves as an attack vector that bypasses normal security controls typically implemented for charging system management, allowing attackers to manipulate charging parameters, access system logs, or potentially disrupt charging operations. This weakness creates a persistent risk for electric vehicle owners and facility managers who rely on these devices for secure energy management.
From an operational perspective, this vulnerability presents significant risks to both individual users and commercial charging infrastructure deployments. Physical attackers can exploit the bypass to perform unauthorized charging activities, potentially leading to energy theft or system manipulation that could result in financial loss for charging station operators. The impact extends beyond simple access denial as attackers could manipulate charging schedules, alter billing parameters, or disable security features entirely. This vulnerability particularly affects environments where physical security is assumed but not enforced, creating an attack surface that may be exploited by malicious actors with access to the charging location. The lack of authentication requirements means that any individual with physical access can immediately exploit this weakness without requiring additional credentials or sophisticated attack vectors.
Organizations and individuals should implement immediate mitigations including securing physical access to charging stations through environmental controls such as locked enclosures, surveillance monitoring, and restricted access zones to prevent unauthorized physical presence. Network segmentation strategies should be employed to isolate charging infrastructure from critical network segments, while regular security assessments should verify that no additional USB-based attack vectors exist within the broader charging ecosystem. Device firmware updates should be prioritized to address this vulnerability when available, though the physical nature of the attack means that environmental controls remain essential. The vulnerability also highlights the importance of secure-by-design principles in IoT and industrial devices where physical interfaces must incorporate appropriate authentication mechanisms to prevent exploitation by attackers with physical access. This case demonstrates how traditional network-based security approaches may be insufficient for protecting devices with exposed physical ports, emphasizing the need for comprehensive security frameworks that address both digital and physical attack surfaces as outlined in the mitre ATT&CK framework for IoT device security.