# CVE-2026-13306: Autel MaxiCharger AC Elite Home authentication bypass in USB interface

Source: https://junglewise.ai/threats/cve-2026-13306-autel-maxicharger-ac-elite-home-authentication-bypass-in-usb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-13306 · Severity: medium · CVSS 4.3 · Published 2026-07-29

A security vulnerability in Autel MaxiCharger AC Elite Home electric vehicle chargers allows an individual with physical access to the device to bypass security controls. By connecting to the charger's exposed USB port, an unauthorized person can access internal system functions without providing a password or credentials. This could lead to unauthorized configuration changes or disruption of the charging service.

Technologies: [Autel MaxiCharger AC Elite Home](https://junglewise.ai/threats/technologies/maxicharger-ac-elite-home). Vendors: [Autel](https://junglewise.ai/threats/vendors/autel).

## Quick answers

**Is CVE-2026-13306 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13306 being exploited in the wild.

**How severe is CVE-2026-13306?** Medium severity, with a CVSS score of 4.3, published 29 July 2026.

**Which products and versions are affected?** Autel MaxiCharger AC Elite Home 1.39.51.

**Is there a fix for CVE-2026-13306?** A patch was published on 2026-07-15: Fixed in firmware version V1.40.81 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13306 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2026-13306?** Check whether you run Autel MaxiCharger AC Elite Home at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authentication vulnerability (CWE-306) exists in the USB interface of the Autel MaxiCharger AC Elite Home EV charger. The flaw is located within the exposed USB port, which fails to require authentication before granting access to system functionality. An attacker with physical access can exploit this lack of access control to bypass authentication mechanisms entirely. The vulnerability was identified in firmware version 1.39.51 and has been addressed in firmware version V1.40.81. Exploitation requires physical proximity to the device but no prior administrative privileges.

## Affected products

- Autel MaxiCharger AC Elite Home 1.39.51

## Timeline

- 2026-03-19: disclosed: Vulnerability reported to vendor
- 2026-07-15: patched: Fixed in firmware version V1.40.81
- 2026-07-15: advisory: Coordinated public release of advisory by ZDI

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-434/](https://www.zerodayinitiative.com/advisories/ZDI-26-434/)

## Related threats

- [Autel MaxiCharger AC Elite Home stack overflow in NFC stack](https://junglewise.ai/threats/cve-2026-13309-autel-maxicharger-ac-elite-home-stack-overflow-in-nfc-stack)
- [Autel MaxiCharger AC Elite Home integer underflow in WebSockets](https://junglewise.ai/threats/cve-2026-13308-autel-maxicharger-ac-elite-home-integer-underflow-in-websockets)
- [Autel MaxiCharger AC Elite Home heap overflow in USB packet handling](https://junglewise.ai/threats/cve-2026-13307-autel-maxicharger-ac-elite-home-heap-overflow-in-usb-packet)
- [Autel MaxiCharger AC Elite Home signature bypass in software update](https://junglewise.ai/threats/cve-2026-13305-autel-maxicharger-ac-elite-home-signature-bypass-in-software)