CVE-2026-13309

Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of card responses via the NFC interface. A crafted card response can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29044.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector : AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.zerodayinitiative.com/advisories/ZDI-26-435/

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de ejecución de código arbitrario por desbordamiento de búfer basado en pila en Autel MaxiCharger AC Elite Home NFC. Esta vulnerabilidad permite a atacantes presentes físicamente ejecutar código arbitrario en instalaciones afectadas de cargadores de vehículos eléctricos Autel MaxiCharger AC Elite Home. La autenticación no es necesaria para explotar esta vulnerabilidad. La falla específica reside en el manejo de las respuestas de la tarjeta a través de la interfaz NFC. Una respuesta de tarjeta manipulada puede desencadenar un desbordamiento de un búfer basado en pila de longitud fija. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del dispositivo. Fue ZDI-CAN-29044.

Information

Published : 2026-07-29 21:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-13309

Mitre link : CVE-2026-13309

CVE.ORG link : CVE-2026-13309

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-13309", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13309", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-30T14:18:19.251087Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "affected": [{"source": "zdi-disclosures@trendmicro.com", "affectedData": [{"vendor": "Autel", "product": "MaxiCharger AC Elite Home", "versions": [{"status": "affected", "version": "1.39.51"}], "defaultStatus": "unknown"}]}], "published": "2026-07-29T21:17:46.607", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-435/", "source": "zdi-disclosures@trendmicro.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of card responses via the NFC interface. A crafted card response can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29044."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n de c\u00f3digo arbitrario por desbordamiento de b\u00fafer basado en pila en Autel MaxiCharger AC Elite Home NFC. Esta vulnerabilidad permite a atacantes presentes f\u00edsicamente ejecutar c\u00f3digo arbitrario en instalaciones afectadas de cargadores de veh\u00edculos el\u00e9ctricos Autel MaxiCharger AC Elite Home. La autenticaci\u00f3n no es necesaria para explotar esta vulnerabilidad.\n\nLa falla espec\u00edfica reside en el manejo de las respuestas de la tarjeta a trav\u00e9s de la interfaz NFC. Una respuesta de tarjeta manipulada puede desencadenar un desbordamiento de un b\u00fafer basado en pila de longitud fija. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del dispositivo. Fue ZDI-CAN-29044."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "zdi-disclosures@trendmicro.com"}