EUVD-2026-46432
GHSA-hmfc-f829-2xf3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach charger management interface over network
-
DeliverySupply hard-coded authentication token
-
ExploitBypass authorization checks
-
ExecutionInvoke privileged management endpoints
-
ImpactFull control of charging station
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The specific prerequisite is a MaxiCharger Single running firmware at or below V1.03.51 whose management endpoints are reachable over the network by the attacker; the attacker must know the hard-coded token value, which is disclosed by the public exploit/firmware analysis. No valid account, no user interaction, and no non-default configuration are required (PR:N/UI:N/AC:L). The principal limiting factor is network reachability of the management interface - deployments where the charger is segmented behind a firewall or not exposed to untrusted networks materially reduce exposure - and applicability is bounded to the MaxiCharger Single product line at or below firmware V1.03.51. |
| Impact | All available signals point to high real-world priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA:H and subsequent-system SC/SI/SA:H) describes network-reachable, low-complexity, unauthenticated exploitation with full impact to both the device and downstream systems - consistent with the 10.0 score. Publicly available exploit code from CyberDanube lowers the barrier to weaponization. There is no CISA KEV listing and no EPSS score provided, so this is not confirmed to be actively exploited; the risk is driven by ease of exploitation and public PoC rather than observed in-the-wild activity. The main mitigating factor is network exposure: risk is highest where the charger's management interface is reachable from untrusted networks or the internet, and lower where it sits behind segmentation. No conflicting signals were found in the input; the primary gap is the absence of EPSS and KEV data to gauge current exploitation frequency. |
| Exploit ScenarioDerived | An attacker who has reverse-engineered the V1.03.51 firmware (or reused the public CyberDanube PoC) sends a request to an internet- or LAN-reachable MaxiCharger Single management endpoint including the hard-coded token value. The token bypasses authorization, granting privileged control of the charger without any valid credentials. Given AV:N/AC:L/PR:N/UI:N, this requires only network reachability and no user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Authentication bypass in Autel MaxiCharger Single EV charging stations running firmware up to and including V1.03.51 lets remote, unauthenticated attackers invoke privileged management endpoints by supplying a hard-coded token baked into the firmware. Because the token is static and shared across devices, anyone who extracts it once (publicly available exploit code exists via CyberDanube) can control the charger's management functions on any unpatched unit. The CVSS 4.0 base score is 10.0, and the flaw affords full compromise of the device with no user interaction.
RemediationAI
No vendor-released patch identified at time of analysis - the only source in the provided data is the CyberDanube research advisory (https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/), which does not cite a fixed firmware version. Operators should contact Autel to obtain firmware newer than V1.03.51 that removes the hard-coded token, and apply it as soon as it is released. Until a fix is available, the most effective compensating control is network isolation: place the charger's management interface on a segmented VLAN with no direct internet exposure and restrict access to a trusted management host or jump box (trade-off: remote OTA/management and cloud features may break). Block inbound access to the affected management ports at the perimeter and via host/upstream firewall ACLs, and monitor the management endpoints for requests carrying the static token. Because the credential is hard-coded, credential rotation is not possible, so access restriction - not secret changes - is the only durable interim control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-798 (Use of Hard-Coded Credentials): the vendor embedded a fixed authentication token in the firmware that acts as a master key, bypassing the normal authorization checks guarding several management endpoints. The affected component is the network-facing management interface of the Autel MaxiCharger Single, a commercial/residential AC EV charging station (cpe:2.3:a:autel:maxicharger_single:*). Hard-coded tokens are a systemic IoT weakness because the secret is identical across every shipped device and cannot be rotated or revoked by operators - reverse-engineering one firmware image discloses the credential for the entire fleet, converting a per-device authorization control into a single universal backdoor.
Know when Maxicharger Single gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable, low-complexity, unauthenticated hard-coded token yields full device compromise; scope changed (S:C) since impact extends to subsequent/downstream systems.
Primary rating from Vendor (CyberDanube).
CVSS VectorVendor: CyberDanube
DescriptionCVE.org
Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to invoke privileged functionality without valid authentication.
Executive ViewAI
Autel MaxiCharger Single EV charging stations (firmware V1.03.51 and earlier) contain a critical authentication bypass (CVE-2026-8983, CVSS 10.0) allowing remote, unauthenticated attackers to gain full administrative control over affected units. Publicly available exploit code exists that leverages a hard-coded firmware token shared across all unpatched devices, enabling unauthorized charger manipulation without any user interaction required. This threatens fleet charging operations, charger availability, and creates a network entry point for potential infrastructure attacks.
No vendor-released patch identified at time of analysis. Interim mitigations include network segmentation (isolate chargers to restricted VLANs), firewall-based access control (restrict management ports to authorized operator IP addresses only), disabling unnecessary remote management features if operationally feasible, intrusion detection rules targeting unauthorized administrative sessions, comprehensive audit logging of all charger access and configuration changes, and air-gapping critical chargers from the internet pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Maxicharger Single
View allUnauthenticated OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a
Remote code execution in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets unauthenticated
Authentication bypass via hard-coded backdoor accounts in Autel MaxiCharger Single EV charging stations (firmware throug
OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a malicious or co
Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1
Physical firmware compromise in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets an attack
Physical compromise of Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 is possible via a
Exploit-DB