CVE-2026-13309: (Pwn2Own) Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability
Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of card responses via the NFC interface. A crafted card response can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29044.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13309?
The severity of CVE-2026-13309 is classified as medium with a score of 6.8.
How do I fix CVE-2026-13309?
To fix CVE-2026-13309, ensure that you apply the latest firmware update provided by Autel for the MaxiCharger AC Elite Home.
What type of vulnerability is CVE-2026-13309?
CVE-2026-13309 is a stack-based buffer overflow vulnerability that allows arbitrary code execution.
Who can exploit CVE-2026-13309?
CVE-2026-13309 can be exploited by physically present attackers without the need for authentication.
What devices are affected by CVE-2026-13309?
CVE-2026-13309 affects the Autel MaxiCharger AC Elite Home EV chargers.