CVE-2026-13306

Received Received - Intake

Authentication Bypass in Autel MaxiCharger AC Elite Home

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Zero Day Initiative

Description

Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the exposed USB interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29046.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-13306

Affected Vendors & Products

Vendor	Product	Version / Range
autel	maxicharger_ac_elite_home	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is an authentication bypass flaw in Autel MaxiCharger AC Elite Home EV chargers. It allows physically present attackers to bypass authentication via the exposed USB interface without requiring any credentials.

Detection Guidance

This vulnerability requires physical access to the Autel MaxiCharger AC Elite Home USB interface. Detection involves inspecting the device for unauthorized access or modifications. Check USB logs or device logs for unusual activity. No remote detection commands are applicable.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the EV charger, potentially controlling charging functions or accessing sensitive data stored on the device.

Compliance Impact

This vulnerability could lead to unauthorized access to connected systems, potentially violating data protection requirements under GDPR or HIPAA if sensitive data is exposed or altered.

Mitigation Strategies

Restrict physical access to the device to prevent unauthorized USB interface use. Disable or secure the USB interface if possible. Monitor device logs for suspicious activity. Apply any firmware updates from Autel if available.

Hi! I’m here to help you understand CVE-2026-13306. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70