CVE-2026-13307: Autel MaxiCharger AC Elite Home RCE Flaw

CVE-2026-13307 Overview

CVE-2026-13307 is a heap-based buffer overflow [CWE-122] in the Autel MaxiCharger AC Elite Home electric vehicle charger. The flaw resides in the handling of custom USB packets and allows arbitrary code execution in the context of the device. Exploitation requires physical access to the charger, and no authentication is needed. The issue was reported through the Zero Day Initiative as ZDI-CAN-29048 and published as ZDI-26-436.

Critical Impact
A physically present attacker can execute arbitrary code on the charger by supplying a crafted USB packet, gaining full control over the device with impact to confidentiality, integrity, and availability.

Affected Products

Autel MaxiCharger AC Elite Home EV chargers
Firmware versions covered by ZDI advisory ZDI-26-436
Devices exposing the vulnerable custom USB packet handler

Discovery Timeline

2026-07-29 - CVE-2026-13307 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-13307

Vulnerability Analysis

The vulnerability exists in the firmware routine that parses custom USB packets on the Autel MaxiCharger AC Elite Home. The parser copies attacker-controlled data into a fixed-length buffer allocated on the heap. Because the length of the incoming data is not validated against the destination buffer size, the copy operation overruns the buffer and corrupts adjacent heap metadata and objects.

An attacker who plugs a malicious USB device into the charger can craft a packet that overwrites heap structures used by the firmware. By shaping the overflow, the attacker can hijack control flow and run arbitrary code in the context of the charger's firmware runtime. This yields full read, write, and execution capabilities on the device.

The attack vector is physical, which limits remote exploitation but is realistic for EV chargers deployed in publicly accessible locations such as parking areas, driveways, and shared garages.

Root Cause

The root cause is missing length validation prior to a memory copy into a heap-allocated buffer of fixed size. The firmware trusts the length field or trailing bytes supplied in the USB packet and does not clamp the copy to the destination buffer size, producing a classic heap-based buffer overflow.

Attack Vector

Exploitation requires the attacker to connect a rogue USB device to the charger's USB interface. Once connected, the attacker sends custom USB packets containing an oversized payload. The vulnerable handler copies the payload into the undersized heap buffer, corrupts adjacent heap chunks, and enables code execution once corrupted pointers or function tables are dereferenced.

The vulnerability does not require credentials, user interaction on the charger, or network access. See the Zero Day Initiative Advisory ZDI-26-436 for additional technical context.

Detection Methods for CVE-2026-13307

Indicators of Compromise

Unexpected USB device connections or enumeration events on MaxiCharger units in physical or video surveillance logs.
Firmware crashes, unscheduled reboots, or watchdog resets on the charger correlated with USB activity.
Unauthorized outbound network connections from the charger to attacker-controlled infrastructure following USB access.
Charger configuration changes, session logs, or billing anomalies with no matching operator action.

Detection Strategies

Monitor charger management platform telemetry for anomalous restarts, firmware hash changes, or unexpected debug output.
Correlate physical access events with device-side events using facility access control and camera systems.
Baseline normal USB usage on chargers and alert on any USB enumeration in production environments where USB should be unused.

Monitoring Recommendations

Enable and centralize charger diagnostic logs where supported by the Autel management backend.
Alert on repeated firmware faults, kernel panics, or heap corruption signatures observed in device logs.
Track network egress from charger VLANs to detect post-exploitation command-and-control traffic.

How to Mitigate CVE-2026-13307

Immediate Actions Required

Physically secure Autel MaxiCharger AC Elite Home units by restricting access to the USB port using tamper-evident enclosures or locked service panels.
Inventory all deployed MaxiCharger devices and identify units in publicly accessible locations for prioritized hardening.
Contact Autel support and monitor vendor channels for firmware updates addressing ZDI-26-436.
Isolate chargers on a dedicated network segment with strict egress filtering to limit blast radius if a device is compromised.

Patch Information

At the time of publication, no vendor patch reference is listed in the NVD entry. Refer to the Zero Day Initiative Advisory ZDI-26-436 and Autel's official support channels for firmware update availability. Apply firmware updates as soon as the vendor releases a fixed version.

Workarounds

Block or disable the USB port physically where operationally feasible, using USB port blockers or epoxy on non-serviceable units.
Deploy the chargers in locations with camera coverage and physical access controls to deter tampering.
Segment charger networks so that a compromised device cannot pivot to corporate or operational technology networks.

bash

# Example egress restriction for a charger VLAN on a Linux gateway
iptables -A FORWARD -i chargers0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i chargers0 -d <autel-cloud-endpoint> -j ACCEPT
iptables -A FORWARD -i chargers0 -j DROP