Autel MaxiCharger EUVD-2026-50558

Physical presence within NFC read range (typically under 10 cm) of the charger is mandatory - remote or network-based exploitation is not possible given AV:P. The NFC card interface must be active and accessible on the device, which is a default operational state for this product. No authentication to the charger is required before the vulnerable code path is triggered, as the overflow occurs during card response processing prior to any authentication outcome. Exploitation is limited to attackers who can physically access the device without raising alarm; for chargers in monitored or access-controlled environments this is a meaningful barrier. The wildcard CPE suggests no firmware version is exempt, but this has not been confirmed by the vendor - specific firmware versions may include mitigations not reflected in the NVD entry.

The CVSS 3.0 base score of 6.8 accurately reflects a constrained but severe vulnerability: AV:P (physical access) is the primary limiting factor, while the impact triad of C:H/I:H/A:H indicates full device compromise if exploited. Real-world risk is geographically and logistically bounded - an attacker must stand within NFC range (typically under 10 cm) of a deployed charger with a crafted card, making remote or internet-scale exploitation impossible. This is not a KEV-listed vulnerability, and no EPSS data was provided in the source intelligence, making probabilistic exploitation forecasting unavailable. For targets of concern - such as chargers in publicly accessible locations (parking garages, fleet depots, commercial properties) - the physical access barrier is lower than it would appear for enterprise IT assets. Compromise of the device firmware could enable persistent tampering, billing fraud, credential harvesting from NFC card data, or lateral movement into the charging network infrastructure if the device has network connectivity. The wildcard CPE version string suggests all firmware versions are affected, but no vendor-confirmed version boundary is available.

An attacker approaches a publicly accessible Autel MaxiCharger AC Elite Home unit - for example, in a parking garage or commercial charging station - and presents a specially crafted NFC card to the charger's reader. The malformed card response triggers a stack buffer overflow in the NFC handling firmware, overwriting the return address and redirecting execution to attacker-supplied shellcode embedded in the card payload. No public proof-of-concept exploit code has been identified, but the ZDI disclosure and precise technical description (fixed-length stack buffer, crafted card response) provide sufficient detail for capable researchers to develop one.