Autel MaxiCharger CVE-2026-13305

Exploitation requires the attacker to be physically present at the charging device - remote unauthenticated exploitation over a network is not possible given AV:P. The vulnerability is triggered specifically through the software update mechanism: the attacker must supply a firmware image via whatever update interface the device exposes (USB port, SD card slot, or local update trigger). No device authentication credential is required (PR:N), meaning any person with physical access and a crafted update image can attempt the attack regardless of ownership. Attack complexity is rated High (AC:H), indicating that successfully bypassing the JWT-based signature check requires non-trivial adversary preparation - likely reverse engineering of the update protocol or JWT structure. Exploitation is limited to: (1) physical proximity to the target device, (2) ability to interface with the update mechanism, and (3) capability to craft a firmware image with a forged or algorithm-bypassed JWT. Default-configured devices in public or semi-public charging installations are at higher risk than units in strictly access-controlled environments.

Real-world risk is meaningfully constrained by the physical access requirement (AV:P) and high attack complexity (AC:H), both confirmed in the CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H vector. These factors reduce opportunistic mass exploitation to near zero - an attacker must be physically present at the charging unit and must craft a valid-looking but malicious firmware package, which is non-trivial. EPSS data is not provided; given AV:P and AC:H, the probability of automated exploitation is inherently very low. No KEV listing is present, and no public exploit code has been identified. Despite the CVSS base score of 6.4 (Medium), the C:H/I:H/A:H impact metrics reflect full device compromise if successfully exploited - which is consistent with RCE on an embedded Linux or RTOS platform. The realistic threat model is a targeted physical attacker (supply-chain tampering, service technician impersonation, or opportunistic attack at publicly accessible charging installations), not a remote mass exploitation campaign. The 'no patch version confirmed' situation is a meaningful gap: without a fixed firmware version, defenders cannot verify remediation status.

An attacker with physical access to the Autel MaxiCharger AC Elite Home - for example, a technician at a semi-public charging installation or an individual with access to a home garage - crafts a malicious firmware image and packages it with a forged or absent JWT signature token. They deliver the image to the device via the update interface (USB, SD card, or local network update trigger); because the device fails to verify the cryptographic signature, it accepts and flashes the image, executing attacker-controlled code in the device's operating context. No public proof-of-concept has been identified, and the JWT bypass technique (algorithm confusion or missing validation) would need to be independently developed by an attacker.