What is the CVSS score of CVE-2026-13305?

CVE-2026-13305 has a CVSS 3.0 base score of 6.4 (Medium). CVSS vector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Autel MaxiCharger CVE-2026-13305

EUVD-2026-50556 MEDIUM

Improper Verification of Cryptographic Signature (CWE-347)

2026-07-29 zdi

GHSA-mp9m-rq8w-3xm6

Jwt Attack RCE Maxicharger Ac Elite Home

6.4

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

6.4 MEDIUM

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Physical presence required per description; AC:H for JWT forge complexity; full C/I/A impact reflects unrestricted RCE on the embedded device.

3.1 AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Physical

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 20:52 vuln.today

DescriptionCVE.org

Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of a user-supplied software update image. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29062.

AnalysisAI

Arbitrary code execution in Autel MaxiCharger AC Elite Home EV chargers is possible for physically present attackers who supply a crafted, unsigned or improperly signed firmware update image to the device. The flaw (CWE-347) stems from the absence of cryptographic signature validation during the software update process - tagged as a JWT attack vector - meaning the update mechanism accepts attacker-controlled images without verifying their authenticity. No public exploit has been identified at time of analysis, and exploitation requires physical proximity, but a successful attack achieves full code execution in the device context with high confidentiality, integrity, and availability impact.

Technical ContextAI

The affected product is the Autel MaxiCharger AC Elite Home residential EV charger, identified by CPE cpe:2.3:a:autel:maxicharger_ac_elite_home:*:*:*:*:*:*:*:* - the wildcard version field indicates all known versions are affected. The root cause is CWE-347 (Improper Verification of Cryptographic Signature), a class of vulnerability where software fails to validate the digital signature of externally supplied data before trusting and executing it. The 'JWT Attack' tag from ZDI suggests the update mechanism relies on JSON Web Tokens for image authentication or integrity binding, and the JWT validation is either absent or bypassable - allowing an attacker to substitute a malicious firmware image without triggering rejection. This is consistent with embedded/IoT update pipelines that implement ad-hoc JWT-based signing schemes susceptible to algorithm confusion, none-algorithm bypass, or missing signature enforcement.

RemediationAI

The primary remediation is to apply any firmware update released by Autel that enforces cryptographic signature validation during the update process; the exact patched firmware version has not been independently confirmed from available data - consult the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-433/ and Autel's official support channels for the specific fixed release. Until a verified patch is applied, the most effective compensating control is physical access restriction: deploy the charger in a secured location (locked enclosure, access-controlled garage, or monitored installation) so that unauthorized individuals cannot reach the update interface. If the charger exposes a USB or SD card update port, physically disable or seal that port. Additionally, establish an asset inventory of deployed MaxiCharger AC Elite Home units and monitor for unexpected firmware version changes as a detection control - tampered devices may report anomalous firmware strings. Disabling self-service firmware update capability in favor of managed, authenticated updates via a controlled backend (if supported by the device) would also reduce the attack surface.