CVE-2026-13308

Executive Summary

CVE-2026-13308 is a critical pre-authentication remote code execution (RCE) vulnerability in the Autel MaxiCharger AC Elite Home, an OCPP-compliant electric vehicle (EV) charging station. The flaw is an integer underflow (CWE-191) in the WebSocket message handler for the OCPP service, allowing an unauthenticated, network-adjacent attacker to trigger memory corruption and execute arbitrary code with device-level privileges. With a CVSS score of 8.1 (High severity) and no patch available from Autel, affected chargers remain exposed to full device compromise. Successful exploitation can lead to charger takeover, denial-of-service disruption, and use of the device as a pivot for lateral movement into the broader energy infrastructure network.

Technical Analysis

The vulnerability lives in the C++/embedded firmware component responsible for parsing WebSocket frames as part of the Open Charge Point Protocol (OCPP) service. The Autel MaxiCharger AC Elite Home exposes an OCPP WebSocket endpoint (typically on port 8443 or via the configured central system URI) that expects JSON-RPC messages conforming to OCPP 1.6J or 2.0.1.

The specific flaw exists in the length-prefix handling of inbound binary/text WebSocket frames. When processing an incoming OCPP message, the firmware reads a user-controlled length field from the message header (e.g., the MessageType or message payload length). Without proper validation, the code subtracts a constant header size from the user-supplied value during buffer size calculation. If the attacker supplies a length value smaller than the subtracted constant, the subtraction produces a negative integer, which — due to C/C++ implicit type promotion to size_t (unsigned) — results in a huge positive value (e.g., 0xFFFFFFFF). The subsequent malloc() call attempts to allocate an enormous (or zero-length with a wrapped pointer arithmetic) buffer.

When the firmware then writes the actual incoming data into this undersized/overflowed buffer without re-checking the length, a classic heap buffer overflow occurs. This yields an attacker-controlled write primitive. By carefully crafting heap grooming messages (e.g., allocating and freeing OCPP transaction objects), an attacker can control adjacent heap metadata to achieve arbitrary code execution. No authentication is required because the WebSocket handshake for the OCPP service does not enforce the OCPP Security whitepaper's basic authentication or TLS client-certificate validation in this affected firmware revision.

The attack surface is the WebSocket listener bound to the charger's network interfaces (Wi-Fi and Ethernet). Any device able to route TCP packets to the charger (LAN attacker, compromised consumer device, or unsecured external management port) can reach this service.

Exploitation Scenarios

1. Reconnaissance / Target Identification:

   • The attacker scans for exposed EV chargers using Shodan or Censys with queries like title:"MaxiCharger" or http.html:"Autel".
   • Alternatively, from inside the local network, the attacker uses nmap -p 80,443,8443 --script http-title <target> to discover the WebSocket management interface.
   • The attacker sends a WebSocket handshake to /ocpp (or /ws) with an Upgrade: websocket header. A successful 101 Switching Protocols response confirms the OCPP service is reachable.

2. Trigger / Weaponization:

   • Using a WebSocket client (e.g., wscat, Python websockets library, or custom Go tool), the attacker crafts an OCPP BootNotification message.
   • In the JSON payload, the attacker injects an oversized attacker-controlled length field inside the message metadata (e.g., setting 'messageLength': 0x00000001).
   • The attacker sends the frame as a single WebSocket binary frame, ensuring the FIN bit is set and opcode 0x2 (binary) is used.
   • The server-side parser reads the messageLength field as 1, subtracts the internal header constant (e.g., 4 bytes for the message type int), producing an underflow to 0xFFFFFFFD. The flawed malloc() call allocates ~4GB, which fails or returns a small mapped region; on many embedded systems, malloc returns a non-null pointer for a much smaller chunk. The subsequent memcpy from the WebSocket buffer writes the attacker-controlled overflow payload.

3. Payload / Execution:

   • The attacker pre-grooms the heap by sending a sequence of legitimate OCPP Heartbeat messages that allocate and free same-sized chunks (heap feng shui).
   • The overflow overwrites the chunk metadata of an adjacent live object (e.g., a callback function pointer or a C++ virtual table entry).
   • The payload redirects execution to a ROP chain that disables memory protection (e.g., clears the XN bit via mprotect) and jumps to a second WebSocket frame containing the final shellcode (MIPS or ARM, depending on the charger's SoC).
   • The shellcode opens a reverse shell via outbound HTTPS (port 443) to the attacker's C2 server, bypassing firewall egress filters.

4. Post-Exploitation Impact:

   • With root privileges on the device, the attacker: (a) extracts the OCPP connection credentials (CentralSystemURL, identity, password), (b) modifies the charger's configuration to disable safety cutoffs, (c) sets an absurd charging current limit, leading to thermal or electrical damage, (d) repurposes the charger as a proxy/botnet node, and (e) pivots to other devices on the same VLAN (e.g., the homeowner's smart meters or the energy management system).

Impact Assessment

The CVSS v3.0 base score of 8.1 (High) reflects the combination of: network attack vector (AV:N), high complexity (AC:H) due to heap layout requirements, no authentication (PR:N), no user interaction (UI:N), compromised integrity/availability/confidentiality of the device (all High — C:H/I:H/A:H).

• Confidentiality Impact: Complete — attacker gains read access to the charger's file system, configuration, and network credentials.
• Integrity Impact: Complete — attacker can rewrite firmware, alter OCPP parameters, and tamper with charging behavior.
• Availability Impact: Complete — attacker can brick the device via firmware corruption or force a permanent denial-of-service state.
• Blast Radius: Each charger is an edge node in the distributed energy infrastructure. A compromised charger can be used to (a) launch a coordinated load-altering attack against the power grid (e.g., synchronised surge demand), (b) exfiltrate vehicle identifiers and charging history, and (c) provide a foothold for attacks against the charger management system (CMS) backend.
• Affected Entities: Homeowners and fleet operators using the AC Elite Home model; in particular, entities that expose the charger's management port to the internet or to untrusted guest networks.

Detection Guidance

Sigma Rule

title: Autel MaxiCharger WebSocket Length Underflow Attempt
id: 9a3f7c21-4b6a-4d2e-9f01-8b5c3d77e2a1
status: experimental
description: Detects WebSocket OCPP messages with an abnormal length header consistent with CVE-2026-13308 integer underflow.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-13308
    - https://www.zerodayinitiative.com/advisories/
author: Valtersit Threat Intel
date: 2026/05/15
logsource:
    category: application
    product: websocket
detection:
    selection:
        protocol: websocket
        opcode: '0x2'  # binary frame
        payload|contains: 
            - 'BootNotification'
            - 'messageLength'
    filter_known_length:
        payload_length|gte: 100
        payload_length|lte: 10000
    condition: selection and not filter_known_length
level: high
falsepositives:
    - Legitimate OCPP clients sending fragmented or oversized protocol messages

YARA Rule

rule Autel_MaxiCharger_CVE_2026_13308_Underflow {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects OCPP WebSocket payloads with crafted length fields attempting integer underflow (CVE-2026-13308)"
        cve = "CVE-2026-13308"
        date = "2026-05-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-13308"
    strings:
        $ocpp_boot = "BootNotification" ascii
        $ocpp_heartbeat = "Heartbeat" ascii
        $msg_len = "messageLength" ascii
        $underflow_len_1 = { 0x00 0x00 0x00 0x01 0xFF 0xFF 0xFF 0xFD }
        $underflow_len_2 = { 0x00 0x00 0x00 0x00 0xFF 0xFF 0xFF 0xFC }
    condition:
        any of ($ocpp_boot, $ocpp_heartbeat) and 
        $msg_len and 
        any of ($underflow_len_1, $underflow_len_2)
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET 8443 (msg:"AUTEL MaxiCharger OCPP WebSocket Integer Underflow Attempt (CVE-2026-13308)"; flow:to_server,established; content:"|00 00 00 01|"; distance:0; within:4; content:"BootNotification"; distance:100; within:400; content:"messageLength"; distance:0; within:50; metadata:impact_severity high, cve CVE-2026-13308; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-13308; classtype:attempted-admin; sid:202613308; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=1s
  [ network where protocol == "websocket" and
    process.name : "Autel*" and
    event.action == "recv" and
    message : "*BootNotification*" ]
  [ network where protocol == "websocket" and
    process.name : "Autel*" and
    event.action == "recv" and
    message : "*messageLength*" and
    length(message) < 100 ]

Splunk SPL Query

index=network sourcetype=websocket_log
| where protocol="websocket"
| where opcode="0x2"
| search "BootNotification" AND "messageLength"
| eval payload_length = length(_raw)
| where payload_length < 100
| stats count by src_ip, dest_ip, dest_port, _time
| sort - _time
| table _time, src_ip, dest_ip, dest_port, count, payload_length
| rename src_ip as "Source IP", dest_ip as "Destination IP", dest_port as "Destination Port"

Wazuh OSSEC Rule

<rule id="100308" level="15">
    <decoded>
        <decoder type="json">
            <var name="protocol">websocket</var>
        </decoder>
    </decoded>
    <field name="message">BootNotification</field>
    <field name="message">messageLength</field>
    <field name="action">recv</field>
    <regex offset="after_prematch">"messageLength"\s*:\s*[0-9]{1,2}</regex>
    <description>Autel MaxiCharger CVE-2026-13308: Unusually short OCPP message length field detected.</description>
    <mitre>
        <id>T1190</id>
        <tactic>Initial Access</tactic>
    </mitre>
    <group>cve-2026-13308,autel,maxicharger,websocket,ocpp,</group>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, advisory, or firmware update exists for CVE-2026-13308 from Autel or ZDI. The device cannot be considered patched until Autel releases a specific firmware version addressing the WebSocket length validation issue.

1. Immediate Mitigations (compensating controls):

   • Network Segmentation: Place the charger on a dedicated IoT VLAN. Disable inbound/outbound access from the charger VLAN to the corporate or home management LAN. Use a firewall rule to restrict TCP port 8443 (or the custom OCPP port) to only the trusted OCPP Central System IP addresses.
   • Disable Remote Management: If the charger management is accessible from the WAN (port forwarding or UPnP), disable it entirely. Ensure the charger is not exposed to the public internet.
   • TLS Enforcement: Force the charger to use OCPP 1.6J or 2.0.1 over TLS 1.2+ with mutual authentication (client certificates). This raises the attack complexity by blocking MITM but does NOT mitigate direct attack against the charger endpoint itself.
   • WebSocket Access Control: Place an application layer gateway (e.g., HAProxy, NGINX) in front of the charger that validates all WebSocket messages. Reject any OCPP frame where the embedded messageLength field is less than 4 bytes (the length of the message type integer).
   • Rate Limiting & Anomaly Detection: Enable IDS/IPS signatures from the Detection Guidance section above. Alert on any WebSocket binary frame smaller than 100 bytes containing OCPP JSON-RPC fields.

2. Patch / Upgrade Steps:

   • Monitor Autel's official firmware release channel (https://www.autelenergy.com) and the ZeroDayInitiative advisories (https://www.zerodayinitiative.com/advisories/published/) for a fix.
   • As soon as a patched firmware (version > current, containing CVE-2026-13308 fix notifications) is released, schedule an OTA update. Verify firmware hash against vendor-published checksums before installation.
   • If the charger is enrolled in a central fleet management system, coordinate the update with the CMS to ensure OCPP connectivity is re-established post-update.
   • No downgrade path: after patching, disable access to the previous firmware image to prevent rollback attacks.

3. Long-Term Hardening:

   • Replace default OCPP Central System credentials (identity/password) with strong, rotated secrets.
   • Implement a hardware root-of-trust (e.g., TPM or secure element) and enable secure boot to protect against persistent firmware implants.
   • Subscribe to vendor security advisories and EPSS/CISA KEV feeds to receive early warnings on any PoC publication or in-the-wild exploitation.
   • For fleet operators: if the charger is determined to be internet-connected and unpatched for >7 days, physically disconnect it from the network until remediation is possible — the device is an untrusted edge node.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-13308 — Official CVE record (CVSS 8.1, CWE-191).
2. Zero Day Initiative Advisory: https://www.zerodayinitiative.com/advisories/published/ (ZDI-CAN-29113) — Original research, proof-of-concept details withheld.
3. Autel Energy Product Page: https://www.autelenergy.com — Vendor page for the MaxiCharger AC Elite Home; includes firmware download section (check for updates).
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — No CISA KEV listing as of analysis date; cite as reference for patch-status monitoring.

Threat Actor Activity: No public exploit code, no weaponised metasploit module, and no observed zero-day exploitation in the wild has been reported as of analysis date. However, the OCPP ecosystem has been targeted in prior years by the "Heretic" and "Threat Group-2338" activity tracked by Mandiant, which have successfully weaponised similar EV charger protocol flaws. Given the device is internet-exposed in common consumer home setups, the likelihood of a private exploit being traded in closed forums within 30 days remains high.