ZDI-26-434: (Pwn2Own) Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability
This vulnerability allows physically present attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the exposed USB interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system.
Other sources
This vulnerability allows physically present attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.3. The following CVEs are assigned: CVE-2026-13306.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ZDI-26-434 - Compensating control
Mitigate physically present USB exploitation by restricting physical access to the affected Autel MaxiCharger AC Elite Home EV chargers’ exposed USB interface (e.g., lock/cover or control access to USB ports).
Event History
Frequently Asked Questions
What is the severity of ZDI-26-434?
The severity of ZDI-26-434 is rated at 4.3 according to the CVSS.
How do I fix ZDI-26-434?
To fix ZDI-26-434, it is recommended to apply any available firmware updates provided by Autel.
Who is affected by ZDI-26-434?
ZDI-26-434 affects users of Autel MaxiCharger AC Elite Home EV chargers who are vulnerable to the authentication bypass.
Can ZDI-26-434 be exploited remotely?
No, exploitation of ZDI-26-434 requires physical access to the affected EV chargers.
What type of vulnerability is ZDI-26-434?
ZDI-26-434 is an authentication bypass vulnerability that allows attackers to bypass security measures on the device.