CVE-2026-13309

Awaiting Analysis Awaiting Analysis - Queue

Stack-based Buffer Overflow in Autel MaxiCharger AC Elite Home

Publication date: 2026-07-29

Last updated on: 2026-07-30

Assigner: Zero Day Initiative

Description

Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of card responses via the NFC interface. A crafted card response can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29044.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-30

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-13309

Affected Vendors & Products

Vendor	Product	Version / Range
autel	maxicharger_ac_elite_home	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability is a stack-based buffer overflow in the Autel MaxiCharger AC Elite Home EV charger's NFC interface. It allows physically present attackers to execute arbitrary code without authentication by sending a specially crafted card response that overflows a fixed-length stack buffer.

Detection Guidance

This vulnerability requires physical access to exploit via NFC interface. Detection may involve checking for unauthorized NFC card interactions or unexpected device behavior. No direct network commands are applicable.

Impact Analysis

If exploited, this vulnerability could allow an attacker near the device to take full control of the charger, potentially leading to unauthorized access, data theft, or disruption of charging operations. Physical access is required for exploitation.

Compliance Impact

This vulnerability allows arbitrary code execution on the device via NFC interface without authentication, which could compromise data integrity and confidentiality. Such unauthorized access may violate compliance requirements for data protection standards like GDPR or HIPAA if sensitive data is exposed or altered.

Mitigation Strategies

Immediately restrict physical access to the device. Disable NFC functionality if not required. Contact Autel for firmware updates addressing this issue.

Hi! I’m here to help you understand CVE-2026-13309. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70