What is CVE-2026-13306?

CVE-2026-13306 is a medium-severity vulnerability in Autel Maxicharger Ac Elite Home, classified under Missing Authentication for Critical Function. CVSS score: 4.3/10. Published 2026-07-29.

How severe is CVE-2026-13306?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Autel Maxicharger Ac Elite Home

CVE-2026-13306

Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the exposed USB interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29046.

Vulnerability class: Broken Authentication

EPSS: 0.002 (7.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

Affected products

Autel Maxicharger Ac Elite Home — versions 1.39.51

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

zdi-disclosures@trendmicro.com (x_research-advisory)

Frequently asked questions

What is CVE-2026-13306?: CVE-2026-13306 is a medium-severity vulnerability in Autel Maxicharger Ac Elite Home, classified under Missing Authentication for Critical Function. CVSS score: 4.3/10. Published 2026-07-29.
How severe is CVE-2026-13306?: Medium severity. CVSS v3 base score is 4.3 out of 10.