CVE-2026-13308: (Pwn2Own) Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability
Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of WebSocket messages related to the OCPP service. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29113.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13308?
The severity of CVE-2026-13308 is rated high with a score of 8.1.
How do I fix CVE-2026-13308?
To fix CVE-2026-13308, update to the latest version of the Autel MaxiCharger AC Elite Home software provided by the vendor.
What types of attacks can be performed using CVE-2026-13308?
CVE-2026-13308 allows remote attackers to perform arbitrary code execution on vulnerable Autel MaxiCharger AC Elite Home chargers.
Do I need authentication to exploit CVE-2026-13308?
No, authentication is not required to exploit CVE-2026-13308.
Which product is affected by CVE-2026-13308?
CVE-2026-13308 affects the Autel MaxiCharger AC Elite Home EV chargers.