CVE-2026-13306

Executive Summary

CVE-2026-13306 is an authentication bypass vulnerability in the Autel MaxiCharger AC Elite Home electric vehicle (EV) charging station, discovered by researchers at Zero Day Initiative (ZDI-CAN-29046). The flaw resides in the device's exposed USB interface, which fails to enforce authentication before granting access to system functionality. A physically present attacker can exploit this vulnerability to bypass the charger's authentication mechanisms, gaining unauthorized access to local configuration, firmware, and diagnostic interfaces. With a CVSS score of 4.3 (Medium severity), the vulnerability requires physical access but no prior authentication or user interaction, making it a realistic target for malicious actors with brief physical access to the device. As of this report, no vendor patch is available, and the vulnerability remains unpatched.

Technical Analysis

CVE-2026-13306 is classified under CWE-306 (Missing Authentication for Critical Function). The vulnerability exists within the Autel MaxiCharger AC Elite Home's exposed USB interface, which is designed to provide local maintenance access for technicians and service personnel. The fundamental flaw is the absence of any authentication enforcement mechanism prior to allowing access to the device's management and configuration functionality via this interface.

From a code-level perspective, the USB interface likely exposes a serial communication channel or a mounted filesystem that interfaces with the device's embedded Linux operating system. Critically, the interface does not implement any challenge-response authentication, token validation, or credential verification before granting access to sensitive operations. When an attacker connects to the USB port, the device treats the connection as a trusted local session, providing direct access to:

• Configuration files — including network settings, Wi-Fi credentials, and OCPP (Open Charge Point Protocol) server configurations.
• Firmware update mechanisms — allowing the attacker to push malicious firmware or downgrade to vulnerable versions.
• Diagnostic and debugging interfaces — exposing system logs, telemetry data, and potentially cryptographic keys or certificates.
• User management functions — potentially allowing creation of new administrative accounts or modification of existing ones.

The attack surface is limited to physical access, meaning the attacker must be in close proximity to the charger. However, given that these devices are commonly installed in residential garages, driveways, and semi-public parking areas, the physical barrier is often minimal. The charger's USB port is typically accessible without disassembling the unit, and no special tools are required for the initial connection.

The technical mechanism relies on the inherent trust the device places in any USB connection. Unlike network-facing interfaces that require authentication at the application layer, the USB interface appears to operate at a lower trust level, exposing the underlying system directly to the connected host. This is a common architectural flaw in IoT and embedded devices where local ports are overlooked in security testing.

The CVSS vector (AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) confirms: physical attack vector, low attack complexity, no privileges required, no user interaction, and a limited scope. The impact is evenly distributed across confidentiality, integrity, and availability, all at a low level — reflecting that the attacker gains access to local system data and functions but the blast radius is contained to the single device.

Exploitation Scenarios

Scenario 1: Credential Harvesting via USB Serial Access

1. Reconnaissance: The attacker physically locates an Autel MaxiCharger AC Elite Home unit installed in a residential garage, corporate parking facility, or a publicly accessible charging station. Using a mobile device or laptop, the attacker identifies the specific model by visual inspection or by accessing the charger's network presence.

2. Trigger: The attacker opens the USB access panel on the device (where present) or connects directly to the exposed USB port using a standard USB-A or USB-C cable connected to a laptop running a serial terminal emulator (e.g., PuTTY, screen, or minicom).

3. Weaponization: Upon connection, the device presents a serial console or diagnostic shell without prompting for credentials. The attacker gains a root or administrative shell session, leveraging the lack of authentication on the USB interface.

4. Execution: Using standard Linux commands (e.g., cat /etc/passwd, cat /etc/shadow, cat /etc/ocpp.conf, strings /var/log/syslog), the attacker extracts Wi-Fi credentials, OCPP server authentication tokens, SSH keys, and user account hashes stored on the device.

5. Post-Exploitation: The attacker uses harvested credentials to pivot into the broader network. The Wi-Fi credentials provide immediate access to the residential or corporate wireless network. The OCPP credentials may allow unauthorized access to the charging network backend. The attacker can also modify configuration files to disable security features or redirect OCPP communications to a malicious server.

Scenario 2: Malicious Firmware Injection

1. Reconnaissance: The attacker targets a fleet of corporate EV chargers, identifying units in accessible parking structures.

2. Trigger: The attacker connects a USB flash drive or a laptop to the USB port and initiates the firmware update process via the exposed diagnostic interface.

3. Weaponization: The attacker crafts a malicious firmware image that maintains nominal charging functionality but includes a backdoor — such as a reverse SSH tunnel, a hidden cron job, or a modified OCPP client that exfiltrates usage data.

4. Execution: The attacker uploads the malicious firmware through the USB interface, bypassing any signature verification that may exist for network-based updates. The device reboots with the compromised firmware.

5. Post-Exploitation: The backdoor establishes a persistent connection to the attacker's command-and-control server, allowing remote access to the device and lateral movement into the connected network. The attacker can monitor charging sessions, manipulate billing data, or disable the charger remotely as a denial-of-service action.

Scenario 3: Configuration Disruption / Sabotage

1. Reconnaissance: An attacker with a grudge against a specific residential or business owner identifies their Autel charger.

2. Trigger: The attacker physically accesses the USB port during a brief moment when the owner is away.

3. Weaponization: Using the unauthenticated console, the attacker runs configuration reset commands or directly edits critical configuration files (e.g., wiping OCPP settings, disabling network interfaces, or setting incorrect voltage/amperage limits).

4. Execution: The attacker corrupts the device configuration, causing the charger to malfunction, fail to authenticate charging sessions, or present unsafe charging parameters.

5. Post-Exploitation: The device becomes non-functional or unsafe, requiring a technician to physically intervene. This can cause significant downtime and potential safety hazards if charging parameters are tampered with.

Impact Assessment

The business impact of CVE-2026-13306 is moderate but non-trivial. The CVSS base score of 4.3 (Medium) reflects the physical access requirement, yet the real-world implications extend beyond the raw score:

• Confidentiality Impact (Low): An attacker can read local configuration files, logs, and diagnostic data. This may expose network credentials (Wi-Fi passwords, OCPP tokens) that enable further network compromise. For corporate environments, this could lead to broader infrastructure penetration.

• Integrity Impact (Low): Configuration files can be modified, firmware can be replaced, and user accounts can be altered. While the per-change impact is low, the cumulative effect can render the charger inoperable or compromised.

• Availability Impact (Low): The attacker can disrupt charging operations, either through configuration corruption or by pushing malicious firmware. For businesses operating charging fleets or for homes relying on the charger for daily EV use, this represents a tangible operational disruption.

• Affected Systems: All Autel MaxiCharger AC Elite Home units with the exposed USB interface are vulnerable. Since no version range is specified, all current firmware versions are presumed affected. The installed base includes residential homeowners, fleet operators, and commercial charging site hosts.

• Blast Radius: The direct impact is contained to the target device. However, the cascading effects of credential harvesting (network intrusion) and malicious firmware (persistent backdoor) extend the blast radius into the connected network and potentially the charging network backend (OCPP infrastructure).

• Exploit Likelihood: Per EPSS (0.00183), the current probability of exploitation in the wild is low, though this reflects the recency of disclosure and the physical access requirement. Historical patterns for EV charger vulnerabilities show that public exploits often emerge within 6–12 months of disclosure.

Detection Guidance

Sigma Rule

title: Suspicious USB Device Registration on Autel MaxiCharger AC Elite Home
id: 6c1f6e9e-2c4f-4e5a-9b8c-1d3e5f7a9b2c
status: experimental
description: Detects unexpected USB device connections or serial console access patterns on Autel MaxiCharger AC Elite Home, potentially indicating CVE-2026-13306 exploitation.
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
    category: process_creation
    product: linux
detection:
    selection_usb_connect:
        EventID: 500
        Image|endswith: '/usb-device-handler'
        CommandLine|contains: 'connect'
    selection_serial_console:
        EventID: 600
        Image|endswith: '/getty'
        CommandLine|contains: 'ttyUSB'
    selection_shell_spawn:
        EventID: 700
        ParentImage|endswith: '/usb-management-daemon'
        Image|endswith: '/bin/sh'
    condition: selection_usb_connect or selection_serial_console or selection_shell_spawn
level: medium
falsepositives:
    - Authorized technician maintenance sessions
    - Regular USB firmware updates by certified installers
fields:
    - Image
    - CommandLine
    - Username
tags:
    - attack.t1200
    - cve.2026.13306

YARA Rule

rule autel_maxicharger_auth_bypass_cve_2026_13306 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malicious firmware or configuration payloads targeting CVE-2026-13306 USB authentication bypass"
        date = "2026-02-15"
        cve = "CVE-2026-13306"
        severity = "medium"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-13306"

    strings:
        $auth_check1 = "OCPP_AUTH" ascii nocase
        $auth_check2 = "AUTH_REQUIRED" ascii nocase
        $auth_check3 = "usb_authenticate" ascii nocase
        $backdoor1 = "reverse_shell" ascii nocase
        $backdoor2 = "dropbear" ascii nocase
        $config_override = "charge_config" ascii nocase
        $firmware_override = "fw_update_skip" ascii nocase
        $shell_payload = "busybox sh" ascii nocase
        $usb_shell = "ttyUSB" ascii nocase

    condition:
        uint16(0) == 0x5A4D or filesize > 100KB // PE or firmware blob
        and (
            (any of ($auth_check*) and any of ($shell_payload, $usb_shell))
            or (any of ($backdoor*) and any of ($firmware_override, $config_override))
        )
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-13306 Autel MaxiCharger USB Auth Bypass - OCPP Data Exfiltration Exfiltrated Credentials"; flow:established,to_server; content:"OCPP"; nocase; content:"Authorization"; nocase; distance:0; content:"Basic"; nocase; within:20; pcre:"/Authorization:\s*Basic\s+([A-Za-z0-9+\/]{20,}={0,2})/Ri"; classtype:attempted-admin; sid:202613306; rev:1; metadata:creator valtersit_com, cve CVE-2026-13306; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-13306;)

Elastic Detection

sequence by host.name with maxspan=15m
  [process where event.module == "auditd" and event.action == "execve" and
     (process.name : "usb-device-handler" or process.name : "getty") and
     process.args : ("ttyUSB*", "ttyACM*")]
  [process where event.module == "auditd" and event.action == "execve" and
     process.parent.name : ("usb-management-daemon", "getty") and
     process.name : ("sh", "bash", "busybox") and
     process.args : ("-i", "-l", "-c")]
  [file where event.module == "auditd" and event.action in ("write", "update") and
     file.path : ("/etc/*", "/opt/autel/*", "/tmp/*") and
     file.name in ("ocpp.conf", "wpa_supplicant.conf", "firmware_update.bin")]

Splunk SPL Query

index=linux_syslog sourcetype=linux_messages OR sourcetype=linux_secure
  (((hostname="autel-charger*" OR hostname="maxicharger*") AND
    (message="*usb*connect*" OR message="*ttyUSB*" OR message="*ttyACM*" OR
     message="*usb-device-handler*")) OR
   (message="*su*" OR message="*sudo*" AND user="root") OR
   (message="*ocpp*" AND message="*auth*fail*") OR
   (message="*system*" AND message="*reboot*" AND NOT source="/var/log/auth.log"))
  [ search index=network sourcetype=firewall action=allow dest_port=22 dest_ip=* 
    | fields dest_ip _time ] 
  | table _time hostname message source
  | sort -_time | head 50

Wazuh OSSEC Rule

<group name="autel_charger">
  <rule id="354076" level="10">
    <if_group>syslog|sshd|auth</if_group>
    <regex>usb|ttyUSB|ttyACM|usb-device-handler</regex>
    <regex>connect|attach|login|shell</regex>
    <description>Autel MaxiCharger (CVE-2026-13306): Potential USB authentication bypass - unauthorized physical access detected</description>
    <group>autel_charger,attacker,system_compromise,pci_dss_11.4,gdpr_IV_35.7d,gpg13_7.1,</group>
    <mitre><id>T1200</id></mitre>
    <options>no_full_log</options>
  </rule>
  <rule id="354077" level="12" frequency="5" timeframe="120">
    <if_matched_sid>20013306</if_matched_sid>
    <same_source_ip/>
    <description>Autel MaxiCharger (CVE-2026-13306): Repeated USB interface access attempts indicating active exploitation</description>
    <group>autel_charger,attacker,system_compromise,</group>
    <mitre><id>T1200</id></mitre>
  </rule>
  <rule id="354078" level="10">
    <if_group>syslog</if_group>
    <regex>ocpp.*(auth|credential|token).*(fail|denied|not)</regex>
    <description>Autel MaxiCharger (CVE-2026-13306): OCPP credential manipulation attempt after USB access</description>
    <group>autel_charger,attacker,impact,offline,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor patch is currently available from any tracked source. The vendor has not released a security advisory, firmware update, or workaround for CVE-2026-13306.

Immediate Mitigations (1–3):

1. Physical Access Restriction: Limit physical access to the charger's USB port. Install lockable enclosures or tamper-evident covers over the USB interface. If the charger is in a shared or public location, install a physical security shroud that requires a key or specialized tool to access the port.

2. Disable USB Interface (if possible): Check the Autel MaxiCharger AC Elite Home administrative menu for an option to disable the USB maintenance port. Some firmware versions may allow disabling diagnostic USB functionality via the web management interface. Consult the device manual or contact Autel support for instructions.

3. Network Segmentation: Place the charger on a separate VLAN or isolated network segment. If the USB interface is compromised and the attacker pivots to the network via harvested Wi-Fi or OCPP credentials, proper segmentation limits lateral movement. Use firewalls to restrict the charger's outbound traffic to only the necessary OCPP endpoints.

Patch/Upgrade Steps (4–5):

4. Monitor for Firmware Updates: Regularly check the Autel product page and security advisories for firmware updates addressing CVE-2026-13306. Subscribe to Autel's security notification mailing list if available.

5. When Patch Is Released: Apply the vendor firmware update as soon as it becomes available. Before patching: (a) back up the device configuration, (b) schedule the update during a maintenance window to avoid charging disruption, (c) verify the firmware checksum after download, and (d) test the update on a single device before fleet-wide deployment.

Long-Term Hardening (6–7):

6. Deploy Tamper Detection: Install the charger in a location with CCTV monitoring and implement environmental tamper alerts. Consider integrating the charger's physical security status into the broader facility monitoring system.

7. Credential Rotation and Key Management: After any potential USB exposure incident, rotate Wi-Fi credentials, OCPP authentication tokens, and any administrative passwords associated with the charger. Implement a policy of periodic credential rotation for all embedded devices.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-13306 — Official NVD record with CVSS metrics, description, and patch status.

2. Zero Day Initiative Advisory (ZDI-CAN-29046): https://www.zerodayinitiative.com/advisories/ZDI-CAN-29046/ — The originating researcher advisory containing technical case details and coordinated disclosure timeline.

3. Autel Product Page: https://www.autelenergy.com/maxicharger-ac-elite-home/ — Vendor product information for the affected device model, including documentation and support contacts.

4. CWE-306 Reference: https://cwe.mitre.org/data/definitions/306.html — MITRE's weakness description for "Missing Authentication for Critical Function," the class of vulnerability this CVE falls under.

5. EPSS Data (FIRST.org): https://www.first.org/epss/ — Exploit Prediction Scoring System dataset showing current exploit likelihood percentile for this CVE.

Exploitation-in-the-Wild Evidence: As of the date of this report, there is no confirmed evidence of active exploitation of CVE-2026-13306 in the wild. CISA has not added this CVE to the Known Exploited Vulnerabilities (KEV) catalog. No public PoC or exploit code has been released. The vulnerability was disclosed as a coordinated disclosure through the ZDI program, which suggests responsible research rather than active malicious use. However, given the unpatched status and the simplicity of the flaw (lack of USB authentication), public exploit development is likely to emerge in the short term. Security teams should treat this vulnerability with elevated priority for physical asset protection despite the medium CVSS score.