MaxiCharger AC Elite Home CVE-2026-13307

Physical presence at the device is an absolute requirement - this is a hardware-level prerequisite enforced by the AV:P CVSS metric, not a policy control. The attacker must be able to physically connect a USB device to the charger's USB port and send custom USB packets to trigger the vulnerable code path. No authentication credential, software account, or network connectivity is required - the flaw exists in the firmware's low-level USB packet processing before any authentication layer. Exploitation is limited by: (1) mandatory physical proximity to the specific charger unit, (2) the need for purpose-built USB hardware or software to generate the malformed packets, and (3) no remote or network-based attack path. The vulnerability does not require a specific non-default configuration - any unit with an accessible USB port and unpatched firmware is susceptible.

The CVSS 3.0 base score of 6.8 accurately reflects the primary mitigating factor: physical access (AV:P) is mandatory, constraining exploitation to individuals with hands-on proximity to the device. All other metrics signal maximum severity - no authentication (PR:N), no user interaction (UI:N), low complexity (AC:L), and full confidentiality, integrity, and availability impact (C:H/I:H/A:H). There is no EPSS data available in the provided intelligence, no CISA KEV listing, and no public proof-of-concept exploit identified at time of analysis - all of which substantially reduce the likelihood of opportunistic, remote, or automated exploitation. The realistic threat actor is a motivated party with physical proximity, such as a technician, installer, or someone with access to charging locations. For organizations operating managed EV charging fleets or public chargers, insider threat and physical tampering scenarios are the primary concern. SSVC signals: exploitation status is none confirmed, automatable is no (requires physical access), technical impact is total - suggesting medium priority in most enterprise environments but elevated priority for operators of shared or publicly accessible charging infrastructure.

An attacker approaches an Autel MaxiCharger AC Elite Home unit in a parking garage, office building, or residential setting and connects a purpose-built USB device programmed to send oversized custom protocol packets. The malformed packet payload overflows the heap buffer in the USB handler, corrupting heap metadata or function pointers, and redirects execution to attacker-controlled shellcode running natively on the charger's embedded processor. No proof-of-concept exploit is publicly available, but the straightforward CWE-122 class and ZDI disclosure make independent reproduction plausible for skilled researchers.