CVE-2026-13309: Autel MaxiCharger Buffer Overflow RCE Flaw

CVE-2026-13309 Overview

CVE-2026-13309 is a stack-based buffer overflow [CWE-121] in the Autel MaxiCharger AC Elite Home electric vehicle charger. The flaw resides in the Near Field Communication (NFC) card response handler. A physically present attacker can present a crafted NFC card to overflow a fixed-length stack buffer and execute arbitrary code on the device. Authentication is not required. The issue was reported through the Zero Day Initiative as ZDI-CAN-29044 and disclosed as advisory ZDI-26-435.

Critical Impact
Successful exploitation allows unauthenticated code execution in the context of the charger firmware, compromising confidentiality, integrity, and availability of the device.

Affected Products

Autel MaxiCharger AC Elite Home EV charger
NFC card response handling component
Specific firmware versions not enumerated in the advisory

Discovery Timeline

2026-07-29 - CVE-2026-13309 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-13309

Vulnerability Analysis

The vulnerability exists in the firmware routine that parses responses returned from NFC cards presented to the MaxiCharger AC Elite Home. The routine copies data from the card response into a fixed-length buffer allocated on the stack without validating the length of the incoming payload. When the response exceeds the buffer size, adjacent stack memory — including saved return addresses and control data — is overwritten.

Because the NFC interface is exposed to any user who can physically approach the charger, exploitation does not require prior authentication or credentials. The attacker only needs an emulator or programmable card capable of returning a crafted response frame.

Root Cause

The root cause is missing bounds checking during the copy of NFC card response data into a stack-allocated buffer, categorized under [CWE-121] Stack-based Buffer Overflow. The firmware trusts the length or content of attacker-supplied card data.

Attack Vector

The attack vector is physical (AV:P). An adversary must be within NFC read range of the charger and present a crafted card or NFC-emulating device. Once the malformed response is processed, the attacker gains code execution in the context of the charger firmware, which can be used to alter charging behavior, pivot into connected networks, or persist on the device. See the Zero Day Initiative Advisory ZDI-26-435 for the technical writeup.

Detection Methods for CVE-2026-13309

Indicators of Compromise

Unexpected charger reboots, crashes, or watchdog resets following NFC card interactions
NFC authentication attempts using unknown or malformed card identifiers
Unauthorized outbound network connections initiated by the charger to non-vendor infrastructure
Firmware integrity checks failing or configuration changes with no corresponding administrative action

Detection Strategies

Review NFC transaction logs for anomalous response sizes or repeated failed reads from the same card
Correlate physical access events (site cameras, badge readers) with charger diagnostic events
Monitor the charger management platform for devices reporting firmware anomalies or unexpected reconnects

Monitoring Recommendations

Enable and centralize logging from the Autel cloud management console where supported
Place chargers on segmented network VLANs and monitor egress traffic for unusual destinations or protocols
Track patch level and firmware version inventory across the deployed charger fleet

How to Mitigate CVE-2026-13309

Immediate Actions Required

Restrict physical access to installed MaxiCharger AC Elite Home units through enclosures, surveillance, or siting controls
Inventory all affected chargers and confirm firmware versions against vendor advisories
Contact Autel support to obtain firmware guidance for the ZDI-26-435 issue
Isolate chargers on a dedicated network segment with strict egress filtering

Patch Information

At the time of publication, the Zero Day Initiative Advisory ZDI-26-435 is the primary public reference. Operators should apply firmware updates released by Autel as soon as they become available and validate installation across every deployed unit.

Workarounds

Physically block or shield the NFC reader surface on chargers that do not require card-based authentication for the deployment
Disable NFC authentication in the charger configuration where the feature is not operationally required
Require supervised access to publicly sited chargers until firmware remediation is applied

bash

# Example: segment chargers to a dedicated VLAN and restrict egress
# (adapt to your network platform)
vlan 42
 name ev-chargers
interface range GigabitEthernet1/0/10-20
 switchport mode access
 switchport access vlan 42
ip access-list extended EV-CHARGER-EGRESS
 permit tcp 10.42.0.0/24 host <autel-cloud-ip> eq 443
 deny   ip  10.42.0.0/24 any log