CVE-2026-13305

Awaiting Analysis Awaiting Analysis - Queue

Improper Signature Verification in Autel MaxiCharger AC Elite

Publication date: 2026-07-29

Last updated on: 2026-07-30

Assigner: Zero Day Initiative

Description

Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of a user-supplied software update image. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29062.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-30

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-13305

Affected Vendors & Products

Vendor	Product	Version / Range
autel	maxicharger_ac_elite_home	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability is in Autel MaxiCharger AC Elite Home EV chargers. It allows attackers with physical access to execute arbitrary code by exploiting improper verification of software update signatures. No authentication is needed to exploit it.

Detection Guidance

This vulnerability involves improper verification of cryptographic signatures during software updates on Autel MaxiCharger AC Elite Home EV chargers. Detection requires checking for unauthorized or unsigned firmware updates on the device. No specific commands are provided in the context.

Impact Analysis

An attacker could gain control of the EV charger, potentially leading to unauthorized access, data theft, or disruption of charging operations. Physical presence is required for exploitation.

Compliance Impact

This vulnerability allows arbitrary code execution on the device without authentication, which could lead to unauthorized access or data breaches. Such breaches may violate compliance requirements under GDPR or HIPAA if sensitive data is exposed or altered.

Mitigation Strategies

Immediately disconnect affected devices from the network and power source. Contact Autel support for verified firmware updates. Ensure all future updates are cryptographically signed and validated before installation.

Hi! I’m here to help you understand CVE-2026-13305. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70