CVE-2026-13309

Executive Summary

CVE-2026-13309 is a stack-based buffer overflow vulnerability in the NFC interface handling of the Autel MaxiCharger AC Elite Home electric vehicle (EV) charger. A physically present attacker can exploit this flaw by presenting a specially crafted NFC card to the charger, achieving arbitrary code execution in the context of the device without requiring any authentication. The vulnerability carries a CVSS score of 6.8 (Medium severity) with high confidentiality, integrity, and availability impacts, though the attack vector is limited to physical proximity. As of this report, no patch is available, and the vulnerability remains unpatched across all known firmware versions.

Technical Analysis

The vulnerability resides in the NFC communication subsystem of the Autel MaxiCharger AC Elite Home EV charger. The device implements an NFC reader interface to support card-based user authentication and payment functionality, a common feature in public and semi-public EV charging infrastructure. When a user presents an NFC card (e.g., an RFID payment card or access credential) to the charger, the embedded firmware processes the card's response data through a proprietary protocol handler.

The flaw manifests in the handler responsible for parsing card response messages. The firmware allocates a fixed-length stack buffer to store incoming card response data. However, the code does not perform adequate bounds checking on the length of the response payload before copying it into this buffer. A malicious NFC card can transmit a response frame that exceeds the expected buffer capacity, causing a stack-based buffer overflow.

The overflow occurs during a memcpy or similar memory copy operation where the source length is derived from attacker-controlled data within the NFC frame. Because the vulnerable buffer resides on the stack, an attacker can overwrite adjacent stack memory, including the saved return address, stack frame pointers, and potentially local variables. By carefully crafting the overflow payload, an attacker can redirect execution flow to arbitrary memory addresses, leading to arbitrary code execution.

The attack surface is significant because the NFC reader is physically exposed on the exterior of the charger, making it accessible to anyone within physical proximity. The vulnerability does not require authentication because the NFC parsing routine executes before any access control checks. The affected code path is reachable even when the charger is in standby or idle state, as the NFC reader is typically always active to accept card presentations.

The vulnerability was identified by ZDI (Zero Day Initiative) under the identifier ZDI-CAN-29044. The flaw is classified under CWE-121 (Stack-based Buffer Overflow), a well-understood vulnerability class that has been exploited in numerous embedded systems. The CVSS vector reflects the physical attack vector (AV:P), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), with high impact across confidentiality, integrity, and availability (C:H/I:H/A:H).

Exploitation Scenarios

The exploitation of CVE-2026-13309 follows a well-defined attack chain that capitalizes on the physical accessibility of the NFC interface and the lack of authentication in the vulnerable parsing routine.

Step 1: Target Identification and Reconnaissance

The attacker identifies an Autel MaxiCharger AC Elite Home charger installed at a residential property, a small business parking lot, or a semi-public charging location. Reconnaissance involves simple physical observation to confirm the charger model and locate the NFC reader interface, typically marked with the contactless payment symbol on the front panel. The attacker may also use publicly available documentation for the charger to identify the default firmware version and confirm it is not patched.

Step 2: Crafting the Malicious NFC Card

The attacker prepares a malicious NFC card or NFC-enabled device (e.g., a smartphone running a custom NFC application) capable of transmitting arbitrary NDEF or ISO 14443 compliant frames. Using a standard NFC development kit, the attacker constructs a response frame with a payload that exceeds the expected buffer size. The payload consists of:

• A padding region of benign data (e.g., 0x41 'A' characters) to fill the legitimate buffer space.
• A crafted return address overwrite that redirects execution to a location in the device's firmware containing useful gadget code (ROP chain) or to an attacker-controlled region if the firmware permits arbitrary memory write operations.
• A malicious payload shellcode or ROP-chain data compiled for the device's architecture (likely ARM, given typical embedded EV charger firmware).

The attacker can determine the exact offset to the return address through firmware extraction and reverse engineering, as the overflow offset is deterministic for a given firmware version.

Step 3: Physical Delivery and Trigger

The attacker physically approaches the charger and presents the malicious NFC card to the reader. No authentication or passcode is required at this stage because the vulnerability exists in the frame-parsing layer that executes before any application-level access control. Upon contact, the charger's NFC controller reads the malicious frame and relays it to the vulnerable parser routine in firmware, triggering the stack overflow.

Step 4: Payload Execution and Privilege Escalation

The crafted overflow hijacks control flow and executes the attacker's payload in the context of the charger's firmware. Depending on the privileges of the vulnerable process (which is typically the main firmware control thread), the attacker gains full control over the device's operating environment. The attacker can:

• Read and modify charger configuration settings, including Wi-Fi credentials, network parameters, and user access lists.
• Disable charging functionality or alter charging schedules to cause denial of service.
• Extract stored user data, including payment card information, user profiles, or access tokens, if the charger stores such data.
• Establish persistent backdoor access via the charger's network interfaces for future remote exploitation.

Step 5: Post-Exploitation and Persistence

Post-exploitation, the attacker may attempt to maintain persistence by modifying the charger's firmware image stored in flash memory or by installing a malicious firmware update. If the charger is connected to a home or business Wi-Fi network, the attacker can use the compromised device as a pivot point for lateral movement into the connected network, accessing other devices or sensitive data. The attacker may also leverage the compromised charger for cryptojacking or as part of a botnet, given that the device remains powered for extended periods.

The physical nature of the attack limits mass exploitation scenarios but enables targeted operations against specific high-value charging locations, particularly those associated with enterprise fleets or executive residences.

Impact Assessment

CVE-2026-13309 poses a critical security risk to affected Autel MaxiCharger AC Elite Home charging units despite the Medium CVSS severity rating of 6.8. The high impact subscores (C:H/I:H/A:H) indicate complete compromise of the device's confidentiality, integrity, and availability.

Business Impact: For residential users, successful exploitation grants an attacker full control over the charging unit, enabling manipulation of charging operations, theft of electrical power, or disruption of recharge cycles. For commercial entities operating charging infrastructure, the impact is more severe: attackers could disable chargers to create denial-of-service conditions affecting fleet operations, compromise network-connected charger management platforms, or exfiltrate payment and user data if the charger stores such information locally.

Affected Systems: This vulnerability affects all Autel MaxiCharger AC Elite Home units with shared firmware code handling NFC communication. Since no specific patched version has been released, all known versions are considered vulnerable. The device's connectivity to local networks (Wi-Fi, Ethernet) and cloud-based management platforms extends the blast radius beyond the device itself.

Blast Radius: A compromised charger that is connected to a home or business network can serve as a gateway for further network attacks. The attacker potentially gains access to the owner's LAN, including computers, smart home devices, and other IoT infrastructure. In enterprise deployments, the compromise of a single charger could facilitate lateral movement to corporate networks, especially if the charger is used in fleet management scenarios with administrative credentials.

CISA KEV Consideration: This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of this report. The EPSS score of 0.00228 (13.6th percentile) indicates a low probability of exploitation in the wild in the near term. However, the physical attack vector significantly lowers the barrier for targeted attacks by skilled adversaries who can develop custom malicious NFC cards.

Detection Guidance

Sigma Rule

title: Autel MaxiCharger NFC Stack Overflow Exploitation Attempt
id: 6a3a7f9e-7b34-4a8b-9e12-31f95d8a24b1
status: experimental
description: Detects anomalous NFC card response patterns on Autel MaxiCharger AC Elite Home that may indicate exploitation of CVE-2026-13309
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-13309
author: Valtersit Threat Intelligence Team
date: 2026/01/15
tags:
    - attack.t1200
    - attack.initial_access
    - cve.2026.13309
logsource:
    product: autel
    service: charger
    definition: 'Requires access to charger firmware logs containing NFC transaction records'
detection:
    selection_length:
        nfc_response_length: 1024+
    selection_anomaly:
        nfc_response_type: 'unexpected_format'
    condition: selection_length and selection_anomaly
falsepositives:
    - Legitimate oversized NFC cards not yet supported by firmware version
    - Firmware testing operations by authorized maintenance personnel
level: high

YARA Rule

rule Autel_MaxiCharger_NFC_Overflow_Payload
{
    meta:
        author = "Valtersit Threat Intelligence Team"
        description = "Detects crafted NFC payloads targeting Autel MaxiCharger AC Elite Home stack buffer overflow (CVE-2026-13309)"
        cve = "CVE-2026-13309"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-13309"
    strings:
        $payload_marker = { 41 41 41 41 41 41 41 41 }  // hex AAAA padding sequence
        $nfc_ident = "MaxiCharger" ascii wide
        $smc_frame = { 50 00 03 00 00 01 }  // Common ISO 14443 APDU header for response frames
        $return_block = { E8 03 00 00 }  // Potential crafted return address pattern (little-endian)
        $rop_marker = { 00 00 00 00 00 00 00 00 }  // Zero padding often used in ROP chains
    condition:
        uint16(0) == 0x4000 and (1 of ($payload_marker, $rop_marker)) and ($smc_frame at 4) or
        ($nfc_ident and #payload_marker > 50 and $return_block)
}

Suricata IDS Rule

alert tcp any any -> any 443 (msg:"AUTEL MaxiCharger NFC Buffer Overflow Exploitation Attempt (CVE-2026-13309)"; flow:to_server; content:"POST"; http_method; content:"MaxiCharger"; http_uri; content:"response"; http_client_body; pcre:"/(.{1024,}).*?\\x41{50,}/Ri"; classtype:attempted-admin; sid:20261330901; rev:1; reference:cve,2026-13309; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-13309;)

Elastic Detection

sequence by host.id, process.pid with maxspan=5m
  [network where process.name : "*charger*" and network.direction : "ingress" and
   network.transport : "tcp" and destination.port : (80, 443, 8080) and
   length(network.bytes) > 1024]
  [file where event.action : "modification" and process.name : "*charger*" and
   file.extension : ("bin", "so", "dll") and
   file.path : ("/usr/local/binary/*", "/opt/charger/*")]

Splunk SPL Query

index=autel_charger sourcetype=nfc_events
| search nfc_response_length > 1024 OR nfc_payload="*AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA*"
| where nfc_auth_required="false"
| eval severity="HIGH"
| eval cve="CVE-2026-13309"
| table _time, charger_id, ip_address, nfc_payload, nfc_response_length, severity, cve
| sort - _time

Wazuh OSSEC Rule

<group name="autel,">
  <rule id="371629" level="12">
    <decoded_as>autel_charger</decoded_as>
    <field name="nfc_response_length">>1024</field>
    <description>Autel MaxiCharger NFC Overflow Attempt Detected (CVE-2026-13309)</description>
    <mitre>
      <id>T1200</id>
    </mitre>
    <group>cve-2026-13309</group>
  </rule>
  <rule id="371630" level="15">
    <decoded_as>autel_charger</decoded_as>
    <field name="nfc_response_type">^malformed$</field>
    <field name="nfc_auth_required">false</field>
    <group>cve-2026-13309</group>
    <description>Malformed NFC response without authentication on Autel Charger</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: Patch confidence is 0/4 — this vulnerability is UNPATCHED. No official firmware update or vendor fix exists as of this report. Autel has not issued a security advisory or released a patched firmware version.

Immediate Mitigations:

1. Physical Access Restriction: Install the charger in a location that restricts physical access, such as a locked garage, gated parking area, or a security-controlled enclosure. Since the attack requires physical proximity to the NFC reader, limiting physical access is the most effective immediate countermeasure.

2. Disable NFC Payment Features: If the charger configuration allows, disable NFC-based authentication and payment functionality through the administration interface or companion mobile application. This removes the vulnerable attack surface entirely. Refer to the charger's user manual for instructions on disabling contactless card functionality.

3. Network Segmentation: Isolate the charger's network connection behind a separate VLAN or firewall segment. Configure the charger to use a guest network rather than the production LAN. This limits the blast radius in the event of a successful compromise, preventing the attacker from directly accessing other network resources.

4. Monitor NFC Activity: Enable and review charger logs for anomalous NFC card presentation patterns, including response frames exceeding expected sizes or repeated failed authentication attempts.

Patch/Upgrade Steps:

1. Continuously monitor Autel's official firmware release channels (Autel Energy website, mobile app notifications) for the release of a patched firmware version addressing ZDI-CAN-29044.

2. When a patch becomes available, apply it promptly through the charger's OTA update mechanism or by manual firmware upload through the SD card port or USB interface as documented in the device manual.

3. Prior to applying any firmware update, verify the checksum and authenticity of the update package to prevent tampering. After applying, verify the firmware version and re-enable NFC features only if the patch documentation confirms the vulnerability is resolved.

Long-Term Hardening:

1. Vendor Evaluation: When purchasing new EV charging equipment, include firmware update commitment and vulnerability disclosure policies as procurement criteria. Request written assurance of a clear OTA update mechanism with defined security patch timelines.

2. Security Monitoring Integration: Integrate charger telemetry and logs into the enterprise SIEM (Splunk, Elastic, or similar) for continuous monitoring. Develop custom detection rules for anomalous NFC patterns as described in the Detection Guidance section.

3. Physical Security Controls: Deploy CCTV surveillance and tamper-resistant enclosures around charging equipment, particularly in semi-public or enterprise installations.

4. Network Access Control: Use 802.1X authentication on the charger's network port to prevent unauthorized lateral movement from a compromised device.

5. Firmware Baseline Management: Maintain a record of the deployed firmware versions across all chargers in the fleet. Establish a rapid-patch SLA for high-severity vulnerabilities once fixes are released.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-13309
2. Zero Day Initiative Advisory (ZDI-CAN-29044): https://www.zerodayinitiative.com/advisories/ZDI-CAN-29044
3. CWE-121 Stack-based Buffer Overflow Reference: https://cwe.mitre.org/data/definitions/121.html
4. Autel Energy Product Page: https://www.autelenergy.com/maxicharger-ac-elite-home
5. MITRE ATT&CK T1200 Hardware Additions: https://attack.mitre.org/techniques/T1200/

Additional Notes: As of the publication date of this report, there are no known threat actor campaigns exploiting CVE-2026-13309 in the wild, and no public exploit code or PoC has been released. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 0.00228 indicates an extremely low immediate exploitation probability, but the physical attack vector and the increasing deployment of EV charging infrastructure make this vulnerability a relevant consideration for organizations managing EV fleets or public charging stations. Security teams should prioritize physical access controls and prepare for the eventual release of a firmware patch.