On July 15, 2026, Trend Micro's Zero Day Initiative published advisory ZDI-26-437, documenting a remote code execution vulnerability in the Autel MaxiCharger AC Elite Home residential charger. The flaw, originating from the Pwn2Own competition, allows a remote attacker to seize control of the device without presenting credentials. The disclosure follows nearly four months of vendor coordination, with the initial report dated March 19, 2026.
- Vulnerability ZDI-26-437 affects only the Autel MaxiCharger AC Elite Home model and enables pre-authentication RCE
- The attack exploits an integer underflow in the parsing of OCPP service WebSocket messages
- Associated CVE CVE-2026-13308 is currently in reserved state with no additional technical details
- ZDI has not published a CVSS score or severity vector for this advisory
The Mechanism: Integer Underflow in OCPP WebSocket Messages
The defect lies in the handling of WebSocket messages for the OCPP service, the Open Charge Point Protocol standard in the EV charging ecosystem. According to the ZDI advisory, the lack of proper validation of user-supplied data can trigger an integer underflow before a buffer allocation. This arithmetic error produces an undersized memory allocation, resulting in a heap overflow or out-of-bounds write in the device's process context.
The charger's embedded ARM/Linux architecture makes the payload executable in the context of the vulnerable process, turning the memory corruption into arbitrary code execution. The pre-authentication nature of the attack removes any access barrier: an attacker with network connectivity to the device can achieve full control without credentials.
From Competition to Real World: The Pwn2Own Genesis
ZDI-26-437 carries the Pwn2Own label, indicating the vulnerability was demonstrated live during the annual hacking competition hosted by Trend Micro. This provenance has dual significance: it confirms the exploit is technically feasible and reliable, and it implies the attack chain is already known to a circle of researchers well beyond ZDI's perimeter.
The path from competition demonstrator to potential replication in an uncontrolled environment is not automatic, but the WebSocket/OCPP component exposes a standardized surface that reduces adaptation complexity. The OCPP service is designed for communication between the charging station and a central management system; its presence on residential devices extends the attack radius beyond the individual consumer.
The Information Void: What the Dossier Does Not Document
The ZDI advisory presents significant gaps that limit overall risk assessment. No specific affected firmware version is declared. There is no indication of whether corrective patches are available from Autel. The CVSS score and vector, standard tools for quantifying severity, have not been published for this advisory.
It also remains unspecified whether the device's attack surface is exposed directly to the internet or requires access to the user's local network. The CVE-2026-13308 record, reserved by the CNA, provides no additional technical details beyond the primary advisory. These limits prevent precisely sizing the population of units actually at risk.
Immediate Actions
Operators managing installations with Autel MaxiCharger AC Elite Home units should consider three immediate actions. First: verify exposure of the OCPP/WebSocket service to untrusted networks, isolating the device via dedicated VLANs or firewall rules that restrict access to authorized charging management endpoints only. Second: monitor network logs for anomalous WebSocket connections to the wallbox, particularly messages of unusual size or repetitive patterns that may indicate attempts to trigger the underflow. Third: contact Autel support directly to explicitly request the status of any corrective firmware updates, documenting the request pending an official response.
For home users, the priority is network segmentation: place the charger in a separate subnet from sensitive devices such as workstations, NAS, or home automation systems. Disable remote access to the device's administration panel where possible, and verify that the router does not expose WebSocket ports to the outside via UPnP or manual configurations.
"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability." — ZDI Advisory ZDI-26-437
Analysis: When the Wallbox Becomes an Entry Point
The emergence of a pre-authentication RCE in a residential charger signals a structural friction point in the energy transition. EV charging devices are designed with industrial protocols — OCPP foremost — built for managed and monitored infrastructure. Their adoption in residential contexts, often without equivalent operational security guarantees, exposes mature protocols to novel threat models.
ZDI's decision to publish the advisory without a CVSS score or patch details may reflect a stall in vendor coordination, or an impact assessment conditioned by the difficulty of mapping the true exposed surface. What remains is a widely deployed residential device with a demonstrated, public vulnerability, awaiting a response.
Information is based on the cited source and current as of publication.
Sources
- http://www.zerodayinitiative.com/advisories/ZDI-26-437/
- https://www.cve.org/CVERecord?id=CVE-2026-13308
- https://www.trendmicro.com/en_us/business/products/one-platform.html