CVE-2026-13307 in MaxiCharger AC Elite Home
Summary
by MITRE • 07/30/2026
Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of custom USB packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29048.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This heap-based buffer overflow vulnerability resides in the Autel MaxiCharger AC Elite Home EV charger firmware, representing a critical security flaw that enables remote code execution without authentication requirements. The vulnerability specifically manifests during the processing of custom USB packets, where the device fails to validate the length of incoming data before copying it into a fixed-length heap-based buffer structure. This fundamental design flaw creates an exploitable condition that allows attackers with physical access to the device to inject malicious code directly into the charger's memory space. The vulnerability was assigned the ZDI-CAN-29048 identifier and represents a significant risk to electric vehicle charging infrastructure security.
The technical implementation of this vulnerability follows a classic heap-based buffer overflow pattern where user-supplied data is copied without adequate bounds checking into a heap-allocated buffer of insufficient size. When an attacker sends a specially crafted USB packet containing excessive data, the copying operation overflows into adjacent memory regions, potentially corrupting critical program state or allowing code injection attacks. This type of vulnerability falls under CWE-121 Heap-based Buffer Overflow, which occurs when a program allocates memory on the heap and then copies more data into that memory than it can hold. The absence of authentication requirements makes this particularly dangerous as any individual with physical access to the device can exploit the vulnerability regardless of network connectivity or user credentials.
The operational impact of this vulnerability extends beyond simple code execution, potentially compromising the entire charging infrastructure and connected vehicle systems. An attacker could gain persistent control over the charger's firmware, modify charging parameters, disable security features, or even redirect power flow to cause damage to vehicles or the electrical grid. The physical presence requirement does not mitigate the risk significantly since many charging stations are located in public areas where unauthorized access is possible. This vulnerability directly impacts the ATT&CK technique T1059 Command and Scripting Interpreter, as well as T1547 Boot or Logon Autostart Execution, allowing attackers to establish persistent access and potentially escalate privileges within the device's operational environment.
Mitigation strategies for this vulnerability should include immediate firmware updates from Autel to address the buffer overflow condition through proper input validation and bounds checking. The device firmware should implement strict length validation for all USB packet data before any memory copying operations occur, ensuring that user-supplied data cannot exceed the allocated buffer capacity. Network isolation measures and physical security controls should be implemented to limit access to charging stations, while monitoring systems should be deployed to detect unusual USB activity patterns. Organizations should also consider implementing device integrity checks and regular security assessments to identify potential exploitation attempts. The vulnerability highlights the importance of secure coding practices in embedded systems and demonstrates how seemingly benign input handling can create critical security weaknesses in IoT devices.