An integer underflow flaw exists in the WebSocket handling of Autel’s MaxiCharger AC Elite Home EV chargers. The vulnerability allows a remote attacker to send malicious OCPP messages that bypass input validation, causing a buffer allocation to use a negative size. This results in arbitrary code execution in the device’s context, giving the attacker full control over the charger. The flaw is a classic integer underflow issue represented by CWE-191.

The affected product family is Autel MaxiCharger AC Elite Home. No specific firmware or software version ranges are listed in the advisory, so any installation of this charger model that is still running the current firmware is potentially vulnerable.

The CVSS base score of 8.1 indicates high severity, amplified by the fact that authentication is not required to exploit the flaw. The EPSS score is less than 1%, implying a low probability of observed exploitation, but the device’s critical role in charging electric vehicles means that a successful exploitation could be catastrophic. The advisory does not list this CVE in the CISA KEV catalog at present. An attacker would need to establish a network connection to the charger’s WebSocket endpoint, send a crafted OCPP message, and wait for the underflow to trigger the code execution.