Autel MaxiCharger EUVD-2026-50560

Exploitation requires network reachability to the charger's OCPP-over-WebSocket service and a crafted WebSocket message containing a malformed length/size value that drives the integer underflow before buffer allocation; no authentication and no user interaction are needed (PR:N/UI:N). Limiting factors: the CVSS High attack complexity (AC:H) indicates success depends on conditions outside the attacker's full control - such as controlling heap allocation state or memory layout to convert the underflow into reliable code execution - so it is not a guaranteed single-shot exploit. Additionally, realistic exposure is constrained by whether the OCPP/WebSocket listener is reachable from the attacker's position, since these chargers frequently connect outbound to a backend rather than exposing an open inbound port.

The CVSS 3.0 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) indicates a network-reachable, unauthenticated flaw with full CIA impact but High attack complexity, reflecting that reliably weaponizing an integer-underflow memory corruption into code execution requires specific conditions or heap grooming rather than a trivial single packet. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so probabilistic and real-world exploitation signals are absent. The realistic risk is meaningful but bounded: full device takeover is possible, yet AC:H plus the niche deployment footprint and the fact that OCPP endpoints are often not directly Internet-exposed (typically reaching a backend over an outbound connection) argue for targeted rather than mass exploitation. This is a genuine high-severity issue for exposed or LAN-adjacent chargers, but the missing EPSS/KEV/POC signals mean widespread active exploitation is not evidenced.

An attacker who can reach the charger's OCPP WebSocket endpoint - for example on the same local network or via an exposed/forwarded management port - sends a crafted WebSocket message whose embedded length field triggers an integer underflow during buffer allocation. The resulting undersized allocation and out-of-bounds write are shaped to hijack execution, running attacker code in the context of the device without any credentials. No public POC is currently identified, and the High attack complexity implies the attacker must reliably control heap/allocation state.