CVE-2026-13305 Overview
CVE-2026-13305 is an arbitrary code execution vulnerability affecting Autel MaxiCharger AC Elite Home electric vehicle chargers. The flaw resides in the device's software update handler, which fails to properly validate the cryptographic signature of user-supplied update images [CWE-347]. An attacker with physical access to the charger can supply a malicious firmware image and execute code in the context of the device. Authentication is not required. The Zero Day Initiative tracked this issue as ZDI-CAN-29062 and published advisory ZDI-26-433.
Critical Impact
Physically present attackers can execute arbitrary code on the charger by loading an unsigned or improperly signed software update, compromising confidentiality, integrity, and availability of the device.
Affected Products
- Autel MaxiCharger AC Elite Home EV charger
- Firmware versions with the vulnerable software update handler (see vendor advisory for specific builds)
- Deployments accepting user-supplied update images without signature verification
Discovery Timeline
- 2026-07-29 - CVE-2026-13305 published to the National Vulnerability Database
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-13305
Vulnerability Analysis
The vulnerability lies in how the Autel MaxiCharger AC Elite Home processes firmware update packages. The device's update routine accepts a user-supplied software image and applies it without correctly verifying the cryptographic signature attached to the payload. Because signature validation is either absent or improperly implemented, the charger treats attacker-controlled binaries as legitimate firmware. Successful exploitation yields code execution in the context of the device firmware, which controls charging logic, network communication, and hardware interfaces.
Exploitation requires physical proximity to the charger and does not require prior authentication. The attack complexity is elevated because the adversary must interact with local update interfaces on the device, but no cryptographic material or credentials are needed to submit a malicious image. See the Zero Day Initiative Advisory ZDI-26-433 for the technical write-up.
Root Cause
The root cause is improper verification of a cryptographic signature during firmware update processing [CWE-347]. The update routine does not enforce a trusted signing authority, does not validate the signature chain, or fails to reject images whose signatures do not match the expected key. This class of defect nullifies the security guarantees that code signing is intended to provide.
Attack Vector
An attacker with physical access to the MaxiCharger unit connects to a locally exposed update interface, such as a USB port, service connector, or on-device management channel. The attacker submits a crafted firmware image containing arbitrary code. The device installs the image, and the attacker's payload executes with the privileges of the update service. This can be used to alter charging behavior, exfiltrate data, pivot into the connected home network, or persist across reboots.
No verified exploit code is publicly available for this vulnerability. Technical details are limited to the ZDI advisory.
Detection Methods for CVE-2026-13305
Indicators of Compromise
- Unexpected firmware version strings reported by the charger or its management app
- Unauthorized physical access events near deployed charger units
- Anomalous outbound network traffic from the charger to unknown destinations
- Charger reboots, service interruptions, or configuration changes not initiated by an administrator
Detection Strategies
- Compare firmware hashes and version metadata against known-good values published by Autel
- Monitor charger management channels for update events that were not scheduled or approved
- Inspect physical enclosures and service ports for signs of tampering or unauthorized connections
Monitoring Recommendations
- Log all firmware update attempts, including source interface and image identifiers, on the charger and any upstream management platform
- Baseline normal network traffic patterns from EV chargers and alert on deviations such as new outbound connections or DNS lookups
- Include EV charging infrastructure in periodic physical security audits and asset inventories
How to Mitigate CVE-2026-13305
Immediate Actions Required
- Restrict physical access to Autel MaxiCharger AC Elite Home units using enclosures, locks, or supervised installation locations
- Disable or physically block unused local service ports on the charger where feasible
- Segment EV chargers onto isolated network segments that cannot reach sensitive internal systems
- Track vendor communications for a firmware release that addresses improper signature verification
Patch Information
At the time of NVD publication, no patched firmware version was referenced in the available advisory. Administrators should consult Autel directly and the Zero Day Initiative Advisory ZDI-26-433 for updates on remediation status and firmware availability.
Workarounds
- Deploy chargers only in physically controlled environments where unauthorized access to service interfaces is not feasible
- Enforce network-layer controls that prevent chargers from initiating arbitrary outbound connections
- Establish a documented process for validating firmware provenance before any manual update is applied to a charger
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
