What is the CVSS score of CVE-2026-13307?

CVE-2026-13307 has a CVSS 3.0 base score of 6.8 (Medium). CVSS vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

MaxiCharger AC Elite Home CVE-2026-13307

EUVD-2026-50559 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-07-29 zdi

GHSA-235j-grhc-6hqc

Buffer Overflow Heap Overflow RCE Maxicharger Ac Elite Home

6.8

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.8 MEDIUM

Physical access mandatory (AV:P); no auth or interaction needed (PR:N/UI:N); full device compromise achieved, scope unchanged (S:U, C:H/I:H/A:H).

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 20:51 vuln.today

DescriptionCVE.org

Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of custom USB packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29048.

AnalysisAI

Heap-based buffer overflow in Autel MaxiCharger AC Elite Home EV chargers enables arbitrary code execution by physically present, unauthenticated attackers via malformed USB packets. The device's USB packet handler copies attacker-controlled data into a fixed-length heap buffer without validating input length, allowing full control of device execution context. Reported by Zero Day Initiative (ZDI-CAN-29048 / ZDI-26-436); no public exploit code identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

The affected product is the Autel MaxiCharger AC Elite Home EV charging unit, identified by CPE cpe:2.3:a:autel:maxicharger_ac_elite_home:*:*:*:*:*:*:*:*. The wildcard version field indicates all known versions are affected. The root cause is CWE-122 (Heap-based Buffer Overflow): the firmware's USB packet processing routine allocates a fixed-length heap buffer but does not validate the length of incoming packet payload before copying user-supplied data into it. An attacker crafting USB packets with oversized payloads can overwrite adjacent heap memory, corrupting control structures and ultimately hijacking the instruction pointer to execute arbitrary code on the embedded device. The attack surface is the physical USB port on the charger unit itself, which appears to accept custom protocol packets without any prior authentication handshake.

RemediationAI

No vendor-released patch identified at time of analysis - the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-436/ should be monitored for firmware update announcements from Autel. Until a firmware fix is available, the primary compensating control is physical access restriction: secure the USB port with a tamper-evident cover or physical lock to prevent unauthorized USB device insertion - this directly eliminates the attack surface since AV:P is a hard prerequisite. For fleet or public charging environments, implement security camera coverage and access logging at charger locations to deter and detect tampering. Disable or physically block the USB port if it is not required for normal charging operations, noting that this may impact diagnostic or configuration workflows. Operators should treat any unexplained USB activity on these units as a potential security incident.