CVE-2026-13309 in MaxiCharger AC Elite Home
Summary
by MITRE • 07/29/2026
Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of card responses via the NFC interface. A crafted card response can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29044.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability represents a critical buffer overflow flaw in the Autel MaxiCharger AC Elite Home EV charger's NFC stack implementation, specifically within the card response handling mechanism. The vulnerability exists due to improper bounds checking when processing NFC card responses, creating a classic stack-based buffer overflow condition that can be exploited by attackers with physical proximity to the device. The flaw is particularly concerning because it operates without requiring authentication, making it accessible to anyone within the device's NFC range and eliminating the need for network access or credential compromise.
The technical implementation of this vulnerability stems from the device's NFC interface processing logic where fixed-length buffers are used to store card response data without adequate validation of input length. When a specially crafted NFC card response exceeds the allocated buffer size, it overflows into adjacent memory segments, potentially corrupting stack canaries, return addresses, or other critical program state information. This allows an attacker to overwrite program execution flow and inject malicious code that executes with the privileges of the NFC processing service, typically running at system level. The vulnerability's classification aligns with CWE-121 Stack-based Buffer Overflow, which specifically addresses buffer overflows occurring in stack memory regions.
Operationally, this vulnerability presents significant risks for EV charging infrastructure security as it enables attackers to gain persistent control over the charging device. An attacker with physical access can execute arbitrary code to modify charging parameters, potentially creating safety hazards or enabling unauthorized electricity consumption. The exploitability is enhanced by the requirement of only physical proximity rather than network connectivity, making it particularly dangerous in public charging environments where attackers could exploit the vulnerability during normal charging operations. This vulnerability directly impacts the device's integrity and availability, potentially allowing for denial-of-service conditions or complete system compromise.
Mitigation strategies should focus on implementing proper input validation and bounds checking within the NFC processing stack to prevent buffer overflows from occurring. Device firmware updates are essential to address this specific implementation flaw, with patching being critical for maintaining operational security of EV charging infrastructure. Network segmentation and physical access controls should be implemented to limit potential exploitation vectors, while monitoring systems should be deployed to detect anomalous NFC activity patterns that might indicate attempted exploitation. Organizations should also consider the broader implications of similar vulnerabilities in IoT devices and implement comprehensive vulnerability management programs. This vulnerability demonstrates the importance of secure coding practices in embedded systems and aligns with ATT&CK technique T1210 Exploitation of Remote Services, though adapted for physical proximity attacks. The ZDI-CAN-29044 identifier indicates this vulnerability was properly documented and tracked through the zero-day initiative, highlighting the need for continuous security assessment of IoT devices in critical infrastructure environments.