CVE-2026-13308 in MaxiCharger AC Elite Home
Summary
by MITRE • 07/29/2026
Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of WebSocket messages related to the OCPP service. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29113.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The Autel MaxiCharger AC Elite Home EV charger represents a critical cybersecurity vulnerability involving a WebSocket integer underflow that enables remote code execution without authentication requirements. This vulnerability specifically targets the OCPP service implementation within the device's web interface, making it particularly dangerous for residential and commercial charging infrastructure. The flaw resides in how the system processes incoming WebSocket messages, creating a pathway for malicious actors to compromise the device's operational integrity.
The technical root cause stems from improper input validation mechanisms within the WebSocket message handling code. When processing OCPP-related communications, the system fails to adequately validate integer values before buffer allocation operations, resulting in an integer underflow condition. This occurs when user-supplied data containing maliciously crafted integer values causes the arithmetic operation to wrap around to an unexpectedly small value, leading to insufficient buffer allocation. The CWE-190 category specifically addresses integer overflow and underflow vulnerabilities, making this instance a direct manifestation of such weaknesses. The vulnerability allows attackers to manipulate the buffer size calculation through crafted WebSocket messages, ultimately enabling memory corruption that can be leveraged for code execution.
Operational impact of this vulnerability extends beyond simple remote code execution to encompass complete device compromise and potential broader network infiltration. Since no authentication is required to exploit this flaw, attackers can immediately gain unauthorized access to the charging station's operational environment. The device operates in residential and commercial settings where physical security may be limited, making it a prime target for exploitation. Once compromised, the attacker could potentially manipulate charging parameters, monitor energy consumption data, or use the device as a pivot point for attacking other networked systems within the facility. This vulnerability directly aligns with ATT&CK technique T1059.007 for command and scripting interpreter and T1210 for exploitation of remote services.
Mitigation strategies should focus on immediate firmware updates from Autel, which would address the integer underflow condition through proper input validation and bounds checking. Network segmentation approaches including firewall rules that restrict WebSocket access to trusted networks can provide temporary protection while updates are deployed. Additionally, implementing network monitoring to detect anomalous WebSocket traffic patterns may help identify exploitation attempts. Organizations should also consider disabling unused web services when possible and maintaining regular security assessments of connected IoT devices. The vulnerability demonstrates the critical importance of input validation in networked embedded systems and highlights why secure coding practices must be enforced throughout the development lifecycle for industrial control systems.