Autel’s MaxiCharger AC Elite Home is vulnerable to a heap‑based buffer overflow caused by insufficient validation of the length of data in custom USB packets. The flaw, identified as CWE‑122, permits a physically present attacker to inject crafted packets that overwrite heap memory and cause arbitrary code execution in the context of the charger’s firmware. Because no authentication is required, any attacker with USB access can exploit this remotely against the device’s internal operating system, potentially allowing full control of the charger’s functions.

The vulnerability affects Autel’s MaxiCharger AC Elite Home electric‑vehicle charging stations. Detailed version information is not provided in the advisory, so all installations of this model type should be considered at risk until a patch is applied.

The CVSS score of 6.8 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation is unlikely at the current time. The vulnerability is not listed in the CISA KEV catalogue. Attackers must have physical access to the charging station in order to supply the malicious USB packets, making the attack a local‑physical threat rather than a remote one. Nonetheless, the impact of arbitrary code execution warrants prompt mitigation.