EUVD-2026-50560
GHSA-h225-8qf9-jw2x
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N/UI:N), but reliably turning an integer underflow into code execution needs memory-state control, so AC:H; full device compromise gives C:H/I:H/A:H.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of WebSocket messages related to the OCPP service. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29113.
AnalysisAI
Remote code execution in Autel MaxiCharger AC Elite Home EV chargers allows unauthenticated network attackers to run arbitrary code on the device by exploiting an integer underflow in the OCPP WebSocket message handler. The flaw stems from missing validation of user-supplied length/size data used in a buffer allocation, giving full compromise of the charger. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported privately through Zero Day Initiative (ZDI-26-437 / ZDI-CAN-29113).
Technical ContextAI
The vulnerability lives in the charger's implementation of the Open Charge Point Protocol (OCPP), the standard application-layer protocol EV chargers use to communicate with a central management system, here carried over a WebSocket transport. CWE-191 (Integer Underflow or Wraparound) describes the root cause: a size/length value derived from an attacker-controlled WebSocket message is decremented or subtracted below zero, wrapping to a very large unsigned value that is then used to size a buffer allocation. This mismatch between the allocated buffer and the data written into it produces memory corruption that can be steered into control-flow hijack. The affected component is identified by CPE cpe:2.3:a:autel:maxicharger_ac_elite_home, an embedded firmware application on the residential AC charger.
RemediationAI
No vendor-released patch version is identified in the available data, and the CPE lists all versions as affected, so the primary action is to obtain and apply the latest Autel MaxiCharger AC Elite Home firmware once released and to monitor the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-26-437/) and Autel's support channels for a fixed build. As compensating controls until a patch is confirmed: restrict network reachability of the charger's OCPP/WebSocket interface so it is not exposed to the Internet or untrusted LAN segments (place it on an isolated VLAN and permit only the outbound connection to the trusted OCPP central management backend), which limits the network attack vector at the cost of remote management flexibility; and filter or terminate WebSocket traffic through a trusted reverse proxy or gateway that validates OCPP message framing, accepting the operational overhead this adds. Avoid direct port-forwarding of the charger's management port.
More in Maxicharger Ac Elite Home
View allHeap-based buffer overflow in Autel MaxiCharger AC Elite Home EV chargers enables arbitrary code execution by physically
Stack-based buffer overflow in the NFC card response handler of Autel MaxiCharger AC Elite Home EV chargers enables arbi
Arbitrary code execution in Autel MaxiCharger AC Elite Home EV chargers is possible for physically present attackers who
Authentication bypass on the Autel MaxiCharger AC Elite Home EV charger allows physically present attackers to access de
Same weakness CWE-191 – Integer Underflow
View allShare
External POC / Exploit Code
Leaving vuln.today