CVE-2026-13305 Code injection in MaxiCharger AC Elite Home
Physically present attackers can execute arbitrary code on Autel MaxiCharger AC Elite Home EV chargers due to improper verification of software update signatures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13305?
CVE-2026-13305 is a medium-severity code injection vulnerability in Autel MaxiCharger AC Elite Home, published on 29 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of a user-supplied software update image. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29062.
Weakness: CWE-347
Which versions are affected by CVE-2026-13305?
How do I fix CVE-2026-13305?
No fix has been published for CVE-2026-13305 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-13305 being exploited?
There is no known exploitation of CVE-2026-13305 in the wild and no public exploit code.
Sources
Also known as GHSA-mp9m-rq8w-3xm6.