CVE-2026-13308 Overview
CVE-2026-13308 is an integer underflow vulnerability [CWE-191] in the Autel MaxiCharger AC Elite Home electric vehicle (EV) charger. The flaw resides in the handling of WebSocket messages tied to the Open Charge Point Protocol (OCPP) service. Attackers can trigger the underflow before buffer allocation, leading to remote code execution on the device. Authentication is not required to exploit this issue over the network. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-29113 and disclosed publicly as ZDI-26-437.
Critical Impact
Unauthenticated remote attackers can execute arbitrary code on affected MaxiCharger AC Elite Home units, gaining control over the charging device and its network position.
Affected Products
- Autel MaxiCharger AC Elite Home EV charger
- Devices exposing the OCPP WebSocket service
- Firmware versions prior to the vendor's security fix
Discovery Timeline
- 2026-07-29 - CVE-2026-13308 published to the National Vulnerability Database
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-13308
Vulnerability Analysis
The MaxiCharger AC Elite Home exposes an OCPP-compatible WebSocket interface used to communicate with charging station management systems. When the device parses inbound WebSocket messages, it derives a size value from attacker-controlled fields and uses that value in a subsequent buffer allocation. Because the size arithmetic is not properly validated, a crafted message can drive the calculation below zero and wrap into a very large or otherwise inconsistent unsigned value.
The resulting allocation and subsequent copy operations mismatch the actual data length, corrupting adjacent memory. Attackers can leverage this corruption to redirect execution flow and run arbitrary code in the context of the charger firmware process. The attack is remote, requires no user interaction, and does not require credentials.
Root Cause
The root cause is an integer underflow [CWE-191] in the WebSocket/OCPP message handler. User-supplied length or offset values are subtracted without lower-bound checks, producing an invalid buffer size prior to memory allocation.
Attack Vector
Exploitation occurs over the network by sending a malicious OCPP WebSocket frame to the exposed service on the charger. The attack complexity is high, reflecting the precise message shaping needed to reliably trigger the underflow and achieve code execution, but no authentication or user interaction is required.
No public proof-of-concept code is available. For additional technical detail, refer to the Zero Day Initiative Advisory ZDI-26-437.
Detection Methods for CVE-2026-13308
Indicators of Compromise
- Unexpected inbound WebSocket connections to the charger's OCPP endpoint from unknown hosts or external IP ranges.
- Malformed OCPP messages with unusually large or negative length fields captured in network traces.
- Charger process crashes, reboots, or watchdog resets correlated with WebSocket traffic bursts.
- Outbound connections from the charger to unexpected command-and-control destinations following OCPP traffic anomalies.
Detection Strategies
- Inspect OCPP WebSocket traffic for length-field values that fail sanity checks against message body size.
- Baseline normal OCPP session behavior and alert on deviations such as new peers, unusual message types, or elevated error rates.
- Correlate charger telemetry, syslog, and network flows to identify exploitation attempts against embedded devices.
Monitoring Recommendations
- Segment EV charging equipment onto isolated VLANs and monitor east-west traffic for lateral movement attempts originating from chargers.
- Forward device logs and network metadata to a centralized analytics platform for long-term retention and threat hunting.
- Track vendor advisories and firmware release notes for MaxiCharger products to detect newly disclosed OCPP-related flaws.
How to Mitigate CVE-2026-13308
Immediate Actions Required
- Restrict network access to the charger's OCPP WebSocket service so that only trusted management systems can reach it.
- Place MaxiCharger units behind a firewall and block inbound WebSocket traffic from the public internet.
- Audit existing chargers for exposure using external scanning and internal asset inventory.
- Apply vendor firmware updates as soon as they are released by Autel.
Patch Information
At the time of publication, refer to the Zero Day Initiative Advisory ZDI-26-437 and Autel's product security channels for the fixed firmware version. Deploy the updated firmware across all affected units and verify the new version after installation.
Workarounds
- Disable or firewall the OCPP WebSocket interface where operationally feasible until patched firmware is applied.
- Enforce mutual TLS or VPN tunnels between chargers and the charging station management system to prevent unauthenticated peers from reaching the service.
- Rate-limit and inspect OCPP traffic at a network gateway to drop malformed messages before they reach the device.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
