CVE-2026-13307

Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of custom USB packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29048.

• CWE-122

• https://www.zerodayinitiative.com/advisories/ZDI-26-436/

Published

Jul 29, 2026

Last Modified

Jul 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13283Use after free in AdFilter in Google Chrome on Android prior…7.5
• CVE-2026-1329A flaw has been found in Tenda AX1803 1.0.0.1. The affected …8.8
• CVE-2026-13295The Page Builder by SiteOrigin plugin for WordPress is vulne…6.4
• CVE-2026-1330MeetingHub developed by HAMASTAR Technology has an Arbitrary…8.7
• CVE-2026-13305Autel MaxiCharger AC Elite Home Software Update Improper Ver…6.4
• CVE-2026-13306Autel MaxiCharger AC Elite Home USB Authentication Bypass Vu…4.3
• CVE-2026-13308Autel MaxiCharger AC Elite Home WebSockets Integer Underflow…8.1
• CVE-2026-13309Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overf…6.8
• CVE-2026-1331MeetingHub developed by HAMASTAR Technology has an Arbitrary…9.8
• CVE-2026-13311shell-quote prior to 1.8.5 finalizes parsed tokens in parse(…8.7
• CVE-2026-13314Malicious HTML content could be injected into the content re…2
• CVE-2026-13316A flaw has been found in foreman when HTTP parameters are mo…4.4