CVE-2024-23957: Autel MaxiCharger AC Elite Business C50 DLB Stack Overflow RCE

CVE-2024-23957 is a stack-based buffer overflow (CWE-121) in the DLB_HostHeartBeat handler of the dynamic load-balancing (DLB) protocol on Autel's MaxiCharger AC Elite Business C50 EV charging station: a network-adjacent attacker can send an oversized AES key during heartbeat parsing to overwrite a fixed-length stack buffer and execute arbitrary code on the device with no authentication at all, and NVD's own analysis rates the flaw 8.8 (high) on CVSS v3.1, matching the researchers' submitted score.

CVE-2024-23957 (CWE-121, stack-based buffer overflow; also tracked as CWE-787, out-of-bounds write) affects the Autel MaxiCharger AC Elite Business C50, an AC EV charging station. NVD's description states: "The specific flaw exists within the DLB_HostHeartBeat handler of the DLB protocol implementation. When parsing an AES key, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device" and notes that "authentication is not required to exploit this vulnerability" (NVD).

The flaw was discovered by researchers from Midnight Blue and PHP Hooligans and disclosed through Trend Micro's Zero Day Initiative as ZDI-24-854 (internally tracked as ZDI-CAN-23241), part of a batch of MaxiCharger vulnerabilities demonstrated at Pwn2Own Automotive 2024 in Tokyo. The ZDI advisory was reported to Autel on 2024-02-09 and published 2024-06-21, with an update on 2024-08-15, and records the fix as shipping in US firmware 1.35.00 and EU firmware 1.50.00 (Zero Day Initiative ZDI-24-854).

NVD tracks CVE-2024-23957 with status "Analyzed": it records a CVSS v3.1 score of 8.8 (high), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, submitted by the ZDI's own CNA ([email protected]) and matched by NVD's own independent Primary rating of the same vector and score — the AV:A (adjacent network) component reflects that an attacker needs some form of network access to the charger's local segment, such as the same Wi-Fi or OCPP backend network, rather than being reachable from the open internet (NVD).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00972 (62.2th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).

Operators of MaxiCharger AC Elite Business C50 units should confirm they are running US firmware 1.35.00 / EU firmware 1.50.00 or later, and should segment the charger's management and DLB load-balancing network from any network segment an untrusted device could reach, since the attack vector requires only network adjacency and no credentials.

• The specific flaw exists within the DLB_HostHeartBeat handler of the DLB protocol implementation; when parsing an AES key, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer; authentication is not required to exploit this vulnerability. — NVD
• Discovered by Midnight Blue and PHP Hooligans; reported to Autel 2024-02-09; published as ZDI-24-854 on 2024-06-21, updated 2024-08-15; fixed in US firmware 1.35.00 / EU firmware 1.50.00. — Zero Day Initiative ZDI-24-854
• NVD status 'Analyzed'; Primary and CNA-submitted CVSS v3.1 score both 8.8, vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00972 (62.2th percentile) as of 2026-11-08. — FIRST EPSS