CVE-2026-13306: (Pwn2Own) Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability
Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the exposed USB interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29046.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate CVE described issue by preventing unauthorized physical access to the EV charger’s exposed USB interface (e.g., disable/remove access to the USB interface or restrict physical access to the charger to trusted users only).
- Compensating control
Apply the ZDI-CAN-29046 recommended mitigation for the Autel MaxiCharger AC Elite Home USB authentication bypass (ZDI-CAN-29046).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13306?
CVE-2026-13306 has a medium severity rating of 4.3.
How do I fix CVE-2026-13306?
To mitigate CVE-2026-13306, it is recommended to apply relevant firmware updates from Autel for the MaxiCharger AC Elite Home.
What type of attacks are possible with CVE-2026-13306?
CVE-2026-13306 allows physically present attackers to bypass authentication on the affected EV chargers.
Is user interaction required for exploiting CVE-2026-13306?
No, user interaction is not required to exploit CVE-2026-13306.
What devices are affected by CVE-2026-13306?
The affected devices are the Autel MaxiCharger AC Elite Home EV charger and the Autel MaxiCharger AC Elite Home.