EUVD-2026-46430
GHSA-7rv7-46cm-g66m
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Authentication bypass via hard-coded backdoor accounts in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets remote attackers gain administrative control of the web management interface. Two undocumented privileged accounts use a vendor-defined password derivation tied to device-specific values, so anyone who knows the algorithm and inputs can authenticate as admin without legitimate credentials. Publicly available exploit code exists (CyberDanube); no public evidence of active exploitation at time of analysis.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Maxicharger Single gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from Vendor (CyberDanube) · only source for this CVE.
CVSS VectorVendor: CyberDanube
DescriptionCVE.org
Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web management interface with administrative privileges.
Executive ViewAI
Autel MaxiCharger Single EV charging stations (firmware V1.03.51 and earlier) contain hard-coded backdoor accounts enabling remote attackers to gain full administrative control of the web management interface via authentication bypass. With publicly available exploit code and no vendor patch available, this directly threatens operational continuity and safety of organizations' EV charging infrastructure.
Within 24 hours: No vendor-released patch currently exists; inventory all Autel MaxiCharger Single units and firmware versions in production, then immediately restrict network access to affected stations to trusted administrative networks only. Within 7 days: Implement network segmentation isolating charging station management interfaces, enforce access controls requiring VPN or fixed-IP administrative authentication, and enable comprehensive logging of all administrative access attempts. Within 30 days: Monitor Autel security advisories for vendor patches; if none available, develop a replacement strategy or pursue emergency firmware updates from Autel (contact support immediately for remediation options).
Until vendor patch available: isolate station management interfaces to trusted administrative network only with firewall rules blocking all external access; disable or restrict public internet routing to charging station web interfaces; implement 24/7 monitoring and alerting on all administrative access attempts with immediate incident response procedures; deploy intrusion detection targeting CVE-2026-8982 exploit signatures; contact Autel technical support immediately to determine whether emergency firmware releases or additional compensating controls are available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Maxicharger Single
View allUnauthenticated OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a
Remote code execution in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets unauthenticated
Authentication bypass in Autel MaxiCharger Single EV charging stations running firmware up to and including V1.03.51 let
OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a malicious or co
Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1
Physical firmware compromise in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets an attack
Physical compromise of Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 is possible via a
Exploit-DB