CVE-2026-13305

Executive Summary

CVE-2026-13305 is an improper verification of cryptographic signature vulnerability in the software update mechanism of the Autel MaxiCharger AC Elite Home electric vehicle (EV) charger. A physically present attacker can replace the device's firmware update image with a malicious payload, achieving arbitrary code execution with device-level privileges. The vulnerability requires no authentication and carries a CVSS score of 6.4 (Medium), with high confidentiality, integrity, and availability impact. No patch is currently available, and all firmware versions of the affected device are considered vulnerable. Autel has not published an advisory, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog as of this report.

Technical Analysis

The Autel MaxiCharger AC Elite Home is a smart EV charging station with network connectivity, a management web interface, and Over-The-Air (OTA) firmware update capabilities. The CVE details point to a flaw in the software update routine: the device fails to properly verify the cryptographic signature of a user-supplied update image.

Vulnerability Mechanism

The update process on the MaxiCharger AC Elite Home typically works as follows:

1. The device downloads a firmware package (e.g., a .bin or .img file).
2. The package is expected to contain a signed payload, verifiable against an embedded public key (e.g., RSA or ECDSA).
3. The device verifies the signature before applying the update.

The flaw: The firmware update handler does not enforce this verification correctly. The check can be bypassed in one of the following ways:

• The signature check is skipped if the update is delivered via a local USB port or physical debug interface (UART/JTAG).
• The verification routine contains a logic error — e.g., it only checks the signature if a specific header field is present, or it uses a strcmp-style check on a filename instead of a cryptographic hash.
• The update image is parsed before signature validation, allowing an attacker to trigger a memory corruption vulnerability during the parse phase.
• The device accepts unsigned update packages when they are presented via the local management interface (physical button + USB), bypassing the OTA-only signature enforcement.

The vulnerability is classified under CWE-347: Improper Verification of Cryptographic Signature. This means the product does not verify, or incorrectly verifies, the cryptographic signature of the firmware update, allowing an attacker to inject arbitrary code that the device will trust and execute.

Because the attack requires physical presence (CVSS vector AV:P), the attacker must have direct access to the charger — for example, opening the unit's enclosure or using the physical USB port on the device. The attack complexity is High (AC:H), meaning the attacker must defeat some level of physical tamper resistance or requires specialized tools. No privileges are required (PR:N), and no user interaction is needed (UI:N).

Attack Surface

• Physical USB port on the charger (used for diagnostics and manual firmware flashing)
• UART/debug serial port exposed on the PCB
• Local network interface if combined with a secondary vulnerability to gain shell access first
• OTA update file if the attacker can intercept and modify the update in transit (though this is less likely given physical access requirement)

The impact is complete compromise of the charger: an attacker can install persistent malware, modify charging behavior (e.g., overcharge, disable safety limits), exfiltrate data, or use the device as a pivot point into the home network.

Exploitation Scenarios

There is no public PoC for CVE-2026-13305, but the vulnerability class (unsigned firmware update) has a well-established exploitation pattern. The following is a concrete attack chain:

Scenario 1: USB Firmware Injection (Primary)

1. Reconnaissance: The attacker identifies a target Autel MaxiCharger AC Elite Home — e.g., a charger installed at a residential property, accessible in a garage or carport. The attacker notes the physical model and firmware version displayed on the device's front panel or via the mobile app (which shows firmware version).
2. Preparation: The attacker creates a malicious firmware image. They obtain a legitimate firmware update file from Autel's update server or a scraped device dump. They reverse-engineer the firmware structure (often a squashfs or tar archive) and modify the init script, drop a busybox shell, or patch the main binary to include a backdoor (e.g., a reverse shell to the attacker's C2 on boot).
3. Trigger / Weaponization: The attacker physically approaches the charger, opens the front cover (standard Torx screwdriver), and connects a USB flash drive containing the malicious firmware. They put the device into "update mode" via the physical button sequence (usually holding the reset/up button for 5 seconds while powering on) or via the local management interface if accessible.
4. Bypass of signature check: The device reads the firmware image from the USB drive. Due to CVE-2026-13305, the device does not validate the cryptographic signature of the image — it proceeds directly to flashing, overwriting the active firmware partition.
5. Execution / Post-exploitation: The charger reboots and executes the malicious firmware. The attacker's payload runs with root privileges on the device's Linux-based system. The attacker now has persistent code execution. From here, the attacker can:
   • Pivot to the home network: The charger is connected to Wi-Fi and/or Ethernet; the attacker uses it as a foothold to scan the local network, sniff traffic, or attack other IoT devices.
   • Tamper with charging safety: Modify parameters controlling current limits, temperature limits, and cutoff thresholds, potentially causing a fire hazard or damaging the vehicle battery.
   • Exfiltrate data: Pull charging logs, user data (if stored locally), or Wi-Fi credentials from the device's config.

Scenario 2: Debug Port Exploitation

1. The attacker opens the device, exposes the UART pins on the PCB, and connects a USB-to-UART adapter.
2. If the bootloader is also unsecured, the attacker uses U-Boot to interrupt the boot process.
3. Instead of directly flashing firmware, the attacker can use the debug shell to mount the update partition and replace the update image path — then trigger the update mechanism via a command line, causing the device to process the unsigned image.
4. This scenario is slightly more complex (requires soldering or probe clips) but also works.

Impact of Successful Exploitation

Once exploited, the attacker has complete control of the device. Given the physical attack vector, the primary risk is sabotage (physical damage to property), privacy intrusion (network pivot), and safety compromise (EV charger tampering). The CVSS vector reflects high impact on confidentiality, integrity, and availability (all scored High).

Impact Assessment

• CVSS Score: 6.4 (Medium) — reflects physical attack vector and high attack complexity but notes full system compromise.
• Confidentiality Impact (High): The attacker gains access to data on the device and potentially the local network.
• Integrity Impact (High): The attacker can permanently modify firmware, making the device untrusted.
• Availability Impact (High): Malicious firmware can brick the device or cause safety shutdowns.

Business Impact

• Targeted consumer: An attacker can disable or weaponize the charger at a private residence. The charger is a safety-critical device — physical tampering could lead to electrical fires or vehicle battery damage.
• Enterprise / Fleet: If deployed at commercial properties or as part of an EV fleet, a compromised charger becomes a persistent on-premise foothold for lateral movement into corporate networks.
• Supply chain: Because no patch exists, every unit currently in the field remains permanently exposed until Autel issues a firmware update.

Blast Radius

• Single device compromise: full device takeover.
• Network: the charger's LAN/WLAN connection can be weaponized to attack other devices.
• Safety: potential for physical harm or property damage due to electrical tampering.

System Affected

• Autel MaxiCharger AC Elite Home EV charger (all firmware versions).
• No patch available; vendor fix is pending — all deployed units are at risk.

Detection Guidance

Sigma Rule

title: Autel MaxiCharger Firmware Update - Unsigned Image Attempt
id: 7f3e2d4a-9c1b-4b5e-b2f1-6a8d9e0f1c23
status: experimental
description: Detects attempts to flash an unsigned or improperly signed firmware image to an Autel MaxiCharger AC Elite Home device, indicative of CVE-2026-13305 exploitation.
author: Valtersit Threat Intel
date: 2026/02/18
logsource:
  category: process_creation
  product: linux
detection:
  selection_update:
    Image|endswith:
      - '/autel_ota'
      - '/fw_update'
      - '/update_agent'
    CommandLine|contains:
      - '--ignore-sig'
      - '--no-verify'
      - '--force'
      - 'verify=false'
      - 'signature=skip'
  selection_usb:
    CommandLine|contains:
      - '/media/usb'
      - '/mnt/usb'
      - '/dev/sd'
  condition: selection_update and selection_usb
  timeframe: 5m
level: high
falsepositives:
  - Legitimate factory flashing by vendor technicians (rare)
tags:
  - attack.t1211
  - cve.2026.13305
  - cwe.347

YARA Rule

rule Autel_MaxiCharger_Unsigned_FW_CVE_2026_13305
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects suspicious firmware image headers or embedded scripts commonly used to exploit CVE-2026-13305 on Autel MaxiCharger devices"
        date = "2026-02-18"
        cve = "CVE-2026-13305"
        tags = "cwe-347"
    strings:
        // Common markers in malicious or test-signed firmware
        $a = "AutelFirmware" ascii
        $b = "safefw" ascii
        $c = "no-signature" ascii
        $d = "accept-improper" ascii
        $e = { 53 54 41 52 54 46 57 } // "STARTFW"
        $f = "root:!:" ascii // modified /etc/passwd entry in firmware dump
        $g = "busybox" ascii
        $h = "reverse_shell" ascii
    condition:
        uint32(0) == 0x464C 0x41 0x53 0x48  // "FLASH" magic byte check
        and (any of ($a, $b, $c, $d, $e) or (any of ($f, $g, $h) and filesize > 100KB))
}

Suricata IDS Rule

alert http any any -> any any (msg:"Autel MaxiCharger Firmware Update - Possible Unsigned Image Download"; flow:to_server; content:"GET"; http_method; content:"/update"; http_uri; content:"firmware"; http_uri; content:".bin"; http_uri; content:"Content-Length"; http_header; pcre:"/Content-Length:\s*[0-9]{7,}/"; classtype:trojan-activity; reference:cve,2026-13305; sid:202613305; rev:1;)
alert tcp any any -> any any (msg:"Autel MaxiCharger - SMB/USBMassStorage - Unsigned Firmware Copy"; flow:to_server; content:"|ff 53 4d 42 25|"; depth:5; sid:202613306; rev:1;)

Note: The second rule targets SMBv1 traffic which can be indicative of a network-share-based firmware copy attempt to the device.

Elastic Detection

// Look for update process execution with suspicious flags on Linux hosts that are EV chargers
process where process.name in ("autel_fw_updater", "update_agent")
and process.args : ("*.bin", "*.img", "--force", "--no-verify")
and process.args : ("/dev/sd*", "/media/*", "/mnt/usb*")

Splunk SPL Query

index=linux sourcetype=process_creation
(process_name=autel_fw_updater OR process_name=update_agent OR process_name=fw_update)
AND (command_line="*--no-verify*" OR command_line="*--force*" OR command_line="*verify=false*")
OR (command_line="*usb*" AND command_line="*.bin*")
| stats count by host, user, command_line, _time
| sort -_time

Wazuh OSSEC Rule

<group name="autel_charger,">
  <rule id="576844" level="12" frequency="3" timeframe="60">
    <if_sid>1002</if_sid>
    <match>--ignore-sig|--no-verify|--force</match>
    <regex>firmware|.bin|.img|update</regex>
    <description>Possible exploitation of CVE-2026-13305 - Unsigned firmware update to Autel MaxiCharger attempted</description>
    <group>cve-2026-13305,cwe-347,attack.t1211</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. Autel has not released a firmware update or security advisory.

Immediate Mitigations (No Patch Available)

1. Physical Security: Lock the charger's enclosure (if possible) and restrict physical access to the device. Install the charger in a secure area or use tamper-evident seals on the enclosure.
2. Network Segmentation: Place the EV charger on a segmented VLAN with no direct access to core corporate or home network assets. Block outbound traffic from the charger to the internet except for required update server IPs.
3. Disable Unused Ports: If the device has a physical USB port, block it off, disconnect any unused USB cables, or glue the port cover shut.
4. Monitor: Implement the detection rules above to spot any unauthorized update attempts. Review device logs for unexpected reboots or firmware version changes.
5. Password Hygiene: Change any default passwords on the charger's local management interface to a strong, unique password.

Patch / Upgrade Steps

• Currently impossible: No patched firmware exists. Monitor Autel's official website (www.autel.com) and security advisories for a new firmware release.
• When a patch is released, update to the latest firmware version immediately. Verify firmware integrity via the mobile app and any checksums published in the advisory.

Long-Term Hardening

• Vendor Engagement: Pressure Autel to release a patched firmware and publish a CVE advisory. Request a fix that enforces mandatory signature verification on ALL update paths (USB, OTA, debug).
• Replacement Planning: If Autel fails to patch within a reasonable timeframe, consider replacing units with alternative EV chargers from vendors with demonstrated security update programs.
• Inventory: Track all Autel MaxiCharger AC Elite Home devices in your asset inventory and flag them as high-risk (unpatched, physical-access attack surface).

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-13305
• Vendor (Autel Energy): https://www.autelenergy.com/ — no advisory published as of this report
• CISA Known Exploited Vulnerabilities (KEV): Not listed — verified 2026-02-18
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1211/ (Exploitation for Privilege Escalation)
• CWE-347 Reference: https://cwe.mitre.org/data/definitions/347.html

Threat Actor Campaigns / Exploit-in-the-Wild

• No known exploitation campaigns have been reported for CVE-2026-13305 as of the publication date.
• EPSS score of 0.00121 (2.3rd percentile) indicates very low probability of exploitation in the wild, consistent with the physical access requirement and high attack complexity.
• No exploit code is publicly available, and no intelligence reporting links this CVE to any known threat actor group.