Which versions of Autel MaxiCharger are affected by CVE-2026-8983?

Autel MaxiCharger Single EV charging stations (firmware V1.03.51 and earlier) contain a critical authentication bypass (CVE-2026-8983, CVSS 10.0) allowing remote, unauthenticated attackers to gain…

Is there a public PoC exploit available for CVE-2026-8983?

Yes, a public proof-of-concept exploit is available for CVE-2026-8983. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-8983?

Within 24 hours, identify and inventory all Autel MaxiCharger Single units running V1.03.51 or earlier, assess which devices are remotely accessible, and implement network segmentation to isolate affected chargers on restricted VLANs with no internet exposure. Over the next 7 days, deploy firewall rules to restrict management port access to known administrator IPs, enable detailed logging of all administrative connections, and contact Autel for confirmation of patch availability and firmware release timeline. Within 30 days, establish monitoring for unauthorized access attempts, prepare a firmware upgrade procedure in a test environment, and develop contingency plans to replace or decommission chargers if no vendor patch is released.

Autel MaxiCharger CVE-2026-8983

Q: What is the CVSS score of CVE-2026-8983?

CVE-2026-8983 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-46432 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-07-21 CyberDanube

GHSA-hmfc-f829-2xf3

Authentication Bypass Maxicharger Single Autel

10.0

CVSS 4.0 · Vendor: CyberDanube

Severity by source

Vendor (CyberDanube) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Network-reachable, low-complexity, unauthenticated hard-coded token yields full device compromise; scope changed (S:C) since impact extends to subsequent/downstream systems.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 21:37 vuln.today

CVE Published

Jul 21, 2026 - 21:03 cve.org

CRITICAL 10.0

DescriptionCVE.org

Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to invoke privileged functionality without valid authentication.

AnalysisAI

Authentication bypass in Autel MaxiCharger Single EV charging stations running firmware up to and including V1.03.51 lets remote, unauthenticated attackers invoke privileged management endpoints by supplying a hard-coded token baked into the firmware. Because the token is static and shared across devices, anyone who extracts it once (publicly available exploit code exists via CyberDanube) can control the charger's management functions on any unpatched unit. The CVSS 4.0 base score is 10.0, and the flaw affords full compromise of the device with no user interaction.

Technical ContextAI

The root cause is CWE-798 (Use of Hard-Coded Credentials): the vendor embedded a fixed authentication token in the firmware that acts as a master key, bypassing the normal authorization checks guarding several management endpoints. The affected component is the network-facing management interface of the Autel MaxiCharger Single, a commercial/residential AC EV charging station (cpe:2.3:a:autel:maxicharger_single:*). Hard-coded tokens are a systemic IoT weakness because the secret is identical across every shipped device and cannot be rotated or revoked by operators - reverse-engineering one firmware image discloses the credential for the entire fleet, converting a per-device authorization control into a single universal backdoor.

RemediationAI

No vendor-released patch identified at time of analysis - the only source in the provided data is the CyberDanube research advisory (https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/), which does not cite a fixed firmware version. Operators should contact Autel to obtain firmware newer than V1.03.51 that removes the hard-coded token, and apply it as soon as it is released. Until a fix is available, the most effective compensating control is network isolation: place the charger's management interface on a segmented VLAN with no direct internet exposure and restrict access to a trusted management host or jump box (trade-off: remote OTA/management and cloud features may break). Block inbound access to the affected management ports at the perimeter and via host/upstream firewall ACLs, and monitor the management endpoints for requests carrying the static token. Because the credential is hard-coded, credential rotation is not possible, so access restriction - not secret changes - is the only durable interim control.