Autel MaxiCharger CVE-2026-13306

Exploitation requires physical proximity to the Autel MaxiCharger AC Elite Home device and direct access to its exposed USB port - no remote or network-based exploitation path exists. No credentials, special software, or elevated privileges on the device are required (PR:N per CVSS). Limiting factors: the attacker must physically reach the USB port, which in typical residential installations is accessible only to the homeowner or authorized installer. The 'Home' product designation implies single-family or small residential deployment, further constraining the realistic threat population. Exploitation is not feasible from outside the physical installation location. No specific non-default configuration or feature-flag is required - the missing authentication affects the USB interface in its default, as-shipped state.

The CVSS 3.0 score of 4.3 (Medium) with vector AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L is internally consistent and realistic: physical access (AV:P) is the hard prerequisite that drastically limits the threat population. Attack complexity is low and no authentication is required on the device side, meaning exploitation requires no special skills once physical access is achieved. No EPSS data was provided in the intelligence feed. The vulnerability is absent from the CISA KEV catalog and no POC or exploit code is publicly known, aligning with the niche, physically-constrained nature of the flaw. For a device marketed as a residential home charger, the realistic attacker pool is very narrow - primarily disgruntled household members, contractors, or in shared-facility deployments, other tenants. Risk is meaningfully higher if the device is deployed in semi-public settings such as shared parking garages or multi-unit buildings where the USB port is accessible to untrusted parties.

An attacker in a shared residential parking garage identifies an Autel MaxiCharger AC Elite Home unit assigned to another tenant, connects a USB cable to the exposed interface, and immediately gains access to device functionality - such as configuration, diagnostics, or firmware interaction - without supplying any credentials. Because the device performs no authentication challenge over USB, exploitation is instantaneous upon physical connection. No public exploit tool or POC has been identified, but the simplicity of the flaw means no specialized tooling is needed beyond a standard USB connection.