CVE-2026-13307: (Pwn2Own) Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability
Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of custom USB packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29048.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13307?
The severity of CVE-2026-13307 is classified as medium with a score of 6.8.
What type of vulnerability is CVE-2026-13307?
CVE-2026-13307 is a heap-based buffer overflow vulnerability.
How do I fix CVE-2026-13307?
To mitigate CVE-2026-13307, update the Autel MaxiCharger AC Elite Home to the latest version provided by the vendor.
Who can exploit CVE-2026-13307?
CVE-2026-13307 can be exploited by physically present attackers without the need for authentication.
What can attackers do with CVE-2026-13307?
Attackers can execute arbitrary code on the affected installations of Autel MaxiCharger AC Elite Home.