Autel EV Charger: Remote RCE via OCPP WebSocket, Discovered at Pwn2Own

The ZDI-26-437 advisory, published July 15, 2026 by Trend Micro Zero Day Initiative, discloses a remote code execution vulnerability in the residential Autel MaxiCharger AC Elite Home EV charger. The flaw, discovered in a Pwn2Own context and identified as CVE-2026-13308 with a CVSS score of 8.1 per the ZDI advisory list, allows an unauthenticated remote attacker to fully compromise the device by exploiting an integer underflow in OCPP service WebSocket messages. Vendor notification occurred March 19: nearly four months of coordination before public release.

How the Attack Works: Integer Underflow in OCPP Messages

The Open Charge Point Protocol (OCPP) is the de facto standard for communication between charging stations and central management systems. In its legitimate function, it enables a network operator to monitor device status, start or stop sessions, and update configurations. The Autel implementation, however, contains a critical flaw in parsing these messages.

According to the ZDI advisory, "The specific flaw exists within the handling of WebSocket messages related to the OCPP service. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow prior to allocating a buffer." The resulting memory corruption paves the way for arbitrary code execution. The same source states that "Authentication is not required to exploit this vulnerability" and that "An attacker can leverage this vulnerability to execute code in the context of the device."

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability." — ZDI Advisory ZDI-26-437

The vector is fully remote: no physical access to the charger is required, nor prior compromise of the local network. An attacker with network visibility of the exposed OCPP service can send a malformed WebSocket message that triggers the underflow-allocation-corruption-execution sequence.

Why CVSS 8.1 Is Particularly Severe for a Residential Device

With a score of 8.1 out of 10, the vulnerability sits in the "High" range of the CVSS scale, below the "Critical" threshold (9.0-10.0) but with characteristics that amplify its danger in this specific context. The triple combination — RCE impact, no authentication, remote access — is rare in consumer IoT devices and represents the worst practical scenario for a device the user installs and forgets.

The residential charger is not a router managed by an IT team: it is a critical-infrastructure appliance installed in garages and private parking spots, often connected directly to the internet or exposed via port forwarding to enable remote management. Firmware maintenance depends on the individual manufacturer's responsiveness and the end user's attention, typically low for this product category.

The CVE-2026-13308 record is reserved by CNA per CVE.org, confirming official assignment. However, neither the ZDI advisory nor available sources report the full CVSS vector string nor specify affected or patched firmware versions. The brief does not document specific corrective measures released by Autel.

The Pwn2Own Context: When Competition Validates Real Exploitability

The "(Pwn2Own)" label in the advisory title is not decorative. The Pwn2Own context, organized by Trend Micro ZDI, requires working exploit demonstrations against real, up-to-date targets. A vulnerability emerging from this environment has passed the practical proof filter: it is not a theory, it is a documented real-time compromise before witnesses.

The same ZDI release on July 15, 2026 includes four other advisories related to Autel, with different mechanisms: heap overflow via USB (ZDI-CAN-29048), NFC stack overflow (ZDI-CAN-29044), USB authentication bypass (ZDI-CAN-29046), and update signature bypass (ZDI-CAN-29062). This concentration suggests a broad attack surface in the MaxiCharger family firmware, though sources do not explicitly confirm that models beyond the AC Elite Home are affected by the specific WebSocket flaw.

The brief does not specify the nature of data exposed or compromisable in a successful attack. The dossier also does not document the presence of in-the-wild exploits or active campaigns.

OCPP as Attack Surface: The Interoperability Paradox

The OCPP protocol was born to solve a real problem: charging system fragmentation. Standardized by the Open Charge Alliance, it ensures that chargers from different manufacturers speak the same language with any management backend. But this openness becomes risk when firmware implementation lacks rigorous validation checks on message boundaries.

The integer underflow in question is a classic C/C++ programming error in embedded environments: an unvalidated user-supplied size, decremented below zero, becomes a massive number due to unsigned arithmetic, resulting in an undersized allocation and out-of-bounds writes. That this occurs in an energy IoT device managing household electrical flows makes the flaw not just computational but physical-infrastructural.

The brief does not specify whether the trigger WebSocket message requires particular sizes, precise offsets, or multiple sequences. The dossier also does not document the exact number of devices exposed on the internet nor the presence of active scans or target catalogs.

Immediate Actions

The cited source does not detail specific corrective measures or recommended actions for users or operators. Based on documented data, four priority areas of attention emerge:

• Verify the presence of the Autel MaxiCharger AC Elite Home model in your device fleet and monitor official vendor communications for firmware updates.
• Reduce exposure of OCPP surfaces to the open internet: if the charger is remotely accessible, evaluate network access restrictions pending clarification on patch status.
• Explicitly request information from the vendor or distributor on the availability of corrective firmware for CVE-2026-13308, given that the ZDI advisory does not report a specific patch URL.
• For charging network operators: map any aggregated presence of Autel units in your infrastructure and evaluate network segmentation that isolates OCPP traffic from other critical systems.

Analysis: When the Electric Car Brings the Attacker Into the Garage

The ZDI-26-437 vulnerability embodies a threat transition: devices managing household electrical energy are acquiring the same attack surface as enterprise servers and workstations, but with a fraction of the security visibility. The OCPP protocol, designed for interoperability, becomes a total compromise vector when the implementation treats network data as trusted.

The Autel case is not isolated in the EV landscape: it is indicative of a structural gap. Residential charger manufacturers operate in the consumer market with compressed development cycles, variable security expertise, and commercial incentives skewed toward features and cost. The result is an internet-connected, remotely managed embedded energy IoT device that executes native code without authentication if the message is malformed in just the right way.

The Pwn2Own context has demonstrated that the exploit is not only possible but replicable. The question that remains open, and that the dossier does not resolve, is how many units are actually exposed and on what timeline the vendor will close the flaw.

Information has been verified against cited sources and is current as of publication.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-437/
• http://www.zerodayinitiative.com/advisories/published/
• https://www.cve.org/CVERecord?id=CVE-2026-13308
• https://www.trendmicro.com/
• https://www.trendmicro.com/en_us/business/products/one-platform.html