What is the CVSS score of CVE-2026-13306?

CVE-2026-13306 has a CVSS 3.0 base score of 4.3 (Medium). CVSS vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Autel MaxiCharger CVE-2026-13306

EUVD-2026-50557 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-07-29 zdi

GHSA-593q-wccq-q7r6

Authentication Bypass Maxicharger Ac Elite Home

4.3

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

4.3 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

4.3 MEDIUM

Physical USB connection mandatory (AV:P); no authentication required on device (PR:N); limited CIA impact reflects bounded functionality scope of a residential charger.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 20:52 vuln.today

DescriptionCVE.org

Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the exposed USB interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29046.

AnalysisAI

Authentication bypass on the Autel MaxiCharger AC Elite Home EV charger allows physically present attackers to access device functionality without credentials via the exposed USB interface. The CWE-306 flaw represents a complete absence of authentication on the USB attack surface, not a weak implementation - any USB-connected party is immediately granted access. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; real-world risk is bounded by the physical access prerequisite inherent to the AV:P vector.

Technical ContextAI

The vulnerability stems from CWE-306 (Missing Authentication for Critical Function) on the USB interface of the Autel MaxiCharger AC Elite Home residential EV charging station. EV chargers commonly expose USB ports for diagnostic, configuration, or firmware-update purposes; when these interfaces lack any authentication gate, they become a direct control plane accessible to anyone with physical connectivity. The CPE string cpe:2.3:a:autel:maxicharger_ac_elite_home:*:*:*:*:*:*:*:* uses a full wildcard across all version fields, indicating no version has been identified as unaffected. The disclosed ZDI tracking ID is ZDI-CAN-29046, published by the Zero Day Initiative as ZDI-26-434.

RemediationAI

No vendor-released patch identified at time of analysis - the CPE wildcard and absence of a fix version in the ZDI advisory data confirm no patched firmware version has been publicly specified. The ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-434/ should be checked for updated vendor response or coordinated patch release. As compensating controls: physically block the USB port using a commercial USB port blocker or tamper-evident seal, which prevents unauthorized connectivity without affecting AC charging functionality. In shared or semi-public deployments, mount the charger inside a locked enclosure or restrict physical access to the USB port area. For enterprise fleet deployments, implement physical security logging (cameras, access controls) covering the charger installation point. These controls directly address the AV:P attack vector and are the only effective mitigation until a firmware update is available.