CVE-2026-13305: (Pwn2Own) Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability
Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of a user-supplied software update image. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29062.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ZDI-CAN-29062 - Compensating control
Since the vulnerability can be exploited by a physically present attacker, restrict physical access to the Autel MaxiCharger AC Elite Home EV charger devices (e.g., lock/secure the charger enclosure) to prevent attackers from interacting with the update mechanism.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13305?
The severity of CVE-2026-13305 is rated medium with a score of 6.4.
How does CVE-2026-13305 affect Autel MaxiCharger AC Elite Home users?
CVE-2026-13305 allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers.
What type of attack does CVE-2026-13305 facilitate?
CVE-2026-13305 facilitates arbitrary code execution due to improper verification of cryptographic signatures during software updates.
Is it necessary for an attacker to have physical access for CVE-2026-13305?
Yes, an attacker needs to be physically present to exploit the vulnerability CVE-2026-13305.
How can users protect themselves from CVE-2026-13305?
To protect against CVE-2026-13305, users should ensure that they only install software updates from trusted sources and verify the integrity of updates.