CVE-2026-13307

Awaiting Analysis Awaiting Analysis - Queue

Heap-based Buffer Overflow in Autel MaxiCharger AC Elite Home

Publication date: 2026-07-29

Last updated on: 2026-07-30

Assigner: Zero Day Initiative

Description

Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of custom USB packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29048.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-30

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-13307

Affected Vendors & Products

Vendor	Product	Version / Range
autel	maxicharger_ac_elite_home	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is a heap-based buffer overflow in Autel MaxiCharger AC Elite Home EV chargers that allows physically present attackers to execute arbitrary code without authentication. It occurs due to improper validation of USB packet data length before copying to a fixed heap buffer.

Detection Guidance

This vulnerability involves a heap-based buffer overflow in Autel MaxiCharger AC Elite Home EV chargers via custom USB packets. Detection requires physical access to the device to monitor USB communication for malformed packets or unexpected code execution. No remote detection commands are available due to the nature of the flaw.

Impact Analysis

An attacker with physical access could exploit this to gain control of the EV charger, potentially leading to device compromise, unauthorized access, or operational disruptions. The impact includes high confidentiality, integrity, and availability risks as per CVSS.

Compliance Impact

This vulnerability allows arbitrary code execution on affected Autel MaxiCharger AC Elite Home EV chargers without authentication. Such unauthorized access could lead to data breaches, unauthorized data access, or manipulation, which may violate compliance requirements under GDPR, HIPAA, or other standards that mandate physical and digital security controls for sensitive data.

Mitigation Strategies

Immediately restrict physical access to the Autel MaxiCharger AC Elite Home devices. Disable or unplug the chargers if possible until a firmware update is applied. Contact Autel for patches or mitigation guidance. Monitor vendor advisories for official fixes.

Hi! I’m here to help you understand CVE-2026-13307. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70