# CVE-2026-13305: Autel MaxiCharger AC Elite Home signature bypass in software update

Source: https://junglewise.ai/threats/cve-2026-13305-autel-maxicharger-ac-elite-home-signature-bypass-in-software  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-13305 · Severity: medium · CVSS 6.4 · Published 2026-07-29

The Autel MaxiCharger AC Elite Home, an electric vehicle charging station, is vulnerable to a security flaw in its software update process. A person with physical access to the charger can install a malicious software update, allowing them to take full control of the device. This could lead to unauthorized use of the charger, service disruption, or the theft of data stored on the device.

Technologies: [Autel MaxiCharger AC Elite Home](https://junglewise.ai/threats/technologies/maxicharger-ac-elite-home). Vendors: [Autel](https://junglewise.ai/threats/vendors/autel).

## Quick answers

**Is CVE-2026-13305 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13305 being exploited in the wild.

**How severe is CVE-2026-13305?** Medium severity, with a CVSS score of 6.4, published 29 July 2026.

**Which products and versions are affected?** Autel MaxiCharger AC Elite Home 1.39.51.

**Is there a fix for CVE-2026-13305?** A patch was published on 2026-07-15: Fixed in firmware version V1.40.81 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13305 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2026-13305?** Check whether you run Autel MaxiCharger AC Elite Home at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the software update mechanism of the Autel MaxiCharger AC Elite Home EV charger (specifically version 1.39.51). The device fails to properly validate the cryptographic signature of user-supplied software update images (CWE-347). A physically present attacker can provide a modified firmware image that the device will accept and execute. Successful exploitation allows for arbitrary code execution in the context of the device's operating system. The vulnerability was addressed in firmware version V1.40.81.

## Affected products

- Autel MaxiCharger AC Elite Home 1.39.51

## Timeline

- 2026-03-19: disclosed: Vulnerability reported to vendor
- 2026-07-15: patched: Fixed in firmware version V1.40.81
- 2026-07-15: advisory: Coordinated public release of advisory by ZDI

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-433/](https://www.zerodayinitiative.com/advisories/ZDI-26-433/)

## Related threats

- [Autel MaxiCharger AC Elite Home stack overflow in NFC stack](https://junglewise.ai/threats/cve-2026-13309-autel-maxicharger-ac-elite-home-stack-overflow-in-nfc-stack)
- [Autel MaxiCharger AC Elite Home integer underflow in WebSockets](https://junglewise.ai/threats/cve-2026-13308-autel-maxicharger-ac-elite-home-integer-underflow-in-websockets)
- [Autel MaxiCharger AC Elite Home heap overflow in USB packet handling](https://junglewise.ai/threats/cve-2026-13307-autel-maxicharger-ac-elite-home-heap-overflow-in-usb-packet)
- [Autel MaxiCharger AC Elite Home authentication bypass in USB interface](https://junglewise.ai/threats/cve-2026-13306-autel-maxicharger-ac-elite-home-authentication-bypass-in-usb)