CVE-2026-13306 Overview
CVE-2026-13306 is an authentication bypass vulnerability affecting the Autel MaxiCharger AC Elite Home EV charger. The flaw exists within the exposed USB interface on the device. The interface grants access to functionality without requiring authentication. An attacker with physical access to the charger can exploit this weakness to bypass authentication controls.
The vulnerability was reported through the Trend Micro Zero Day Initiative and tracked internally as ZDI-CAN-29046. It is categorized under [CWE-306]: Missing Authentication for Critical Function. Exploitation requires physical proximity to the affected device.
Critical Impact
Physical attackers can bypass authentication through the USB interface, gaining unauthorized access to device functionality on affected Autel MaxiCharger AC Elite Home EV chargers.
Affected Products
- Autel MaxiCharger AC Elite Home EV Charger
- Devices exposing the vulnerable USB interface
- Refer to the Zero Day Initiative Advisory ZDI-26-434 for specific firmware versions
Discovery Timeline
- 2026-07-29 - CVE-2026-13306 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-13306
Vulnerability Analysis
The Autel MaxiCharger AC Elite Home exposes a USB interface on the device chassis. This interface provides access to internal functionality without enforcing authentication controls. An attacker who physically connects to the USB port can interact with functions that should require prior authentication.
The vulnerability is classified under [CWE-306]: Missing Authentication for Critical Function. The device does not verify the identity of the party issuing commands through the USB interface. This design gap collapses the trust boundary between administrative and unauthenticated contexts.
Exploitation does not require credentials, user interaction, or network reachability. The attacker only needs physical contact with the charger. Impact extends across confidentiality, integrity, and availability at a limited scope.
Root Cause
The root cause is the absence of authentication checks on the exposed USB interface. Firmware routines that handle USB-attached devices treat connections as trusted. No cryptographic handshake, credential prompt, or pairing requirement gates access to sensitive commands.
Attack Vector
The attack vector is physical. An attacker connects a device such as a laptop or a crafted USB peripheral to the charger's USB port. Once connected, the attacker issues commands or accesses functions that authentication should protect. See the Zero Day Initiative Advisory ZDI-26-434 for additional technical detail.
No verified public exploit code is available. The vulnerability mechanism is described in prose above based on the ZDI advisory. Physical access to the charger is the only prerequisite for exploitation.
Detection Methods for CVE-2026-13306
Indicators of Compromise
- Unexpected USB devices connected to the MaxiCharger AC Elite Home unit
- Physical tampering signs on the charger enclosure or USB port area
- Unauthorized configuration changes appearing in the charger management console
- Charging sessions or firmware states that do not match customer or operator records
Detection Strategies
- Perform periodic physical inspections of deployed chargers, focusing on USB ports and enclosure seals
- Compare firmware versions and device configuration against a known-good baseline
- Monitor vendor management platforms for unexplained device resets, reboots, or setting changes
- Review event logs from the charger for administrative actions that lack a corresponding authenticated session
Monitoring Recommendations
- Install physical access controls or tamper-evident seals on chargers deployed in publicly accessible areas
- Deploy CCTV or motion sensors covering charger installations to record physical interaction
- Integrate charger telemetry with a central logging platform to correlate device events with physical access records
- Schedule recurring audits of firmware integrity and device configuration
How to Mitigate CVE-2026-13306
Immediate Actions Required
- Inventory all Autel MaxiCharger AC Elite Home units and identify those installed in publicly accessible locations
- Physically restrict access to the USB interface using enclosures, locks, or port blockers
- Contact Autel support to confirm patch availability and applicable firmware updates
- Increase monitoring frequency for high-risk installations until a fix is applied
Patch Information
Refer to the Zero Day Initiative Advisory ZDI-26-434 for the current remediation status. Apply firmware updates from Autel as soon as they are released for the MaxiCharger AC Elite Home. Verify update integrity through the vendor's management platform after installation.
Workarounds
- Block physical access to the USB port using tamper-evident covers or USB port blockers
- Relocate chargers to areas with restricted physical access where feasible
- Disable or remove non-essential USB functionality if the vendor provides such an option
- Increase the review cadence of charger configuration and firmware state until a patch is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
