Which versions of Autel MaxiCharger are affected by CVE-2026-8984?

Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) contain a critical remote code execution vulnerability allowing unauthenticated attackers to achieve full device compromise;…

Is there a public PoC exploit available for CVE-2026-8984?

Yes, a public proof-of-concept exploit is available for CVE-2026-8984. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-8984?

Within 24 hours: identify all Autel MaxiCharger Single units in operation and audit firmware versions through V1.03.51; implement network access controls to restrict external connectivity to TCP port 9002 if operationally feasible. Within 7 days: contact Autel for firmware update timelines and interim mitigation guidance; deploy network segmentation to isolate charging infrastructure from general corporate networks; enable detailed logging and alerting on port 9002 traffic. Within 30 days: immediately deploy any available Autel firmware patches; perform forensic analysis of all affected stations for compromise indicators; escalate to procurement team regarding replacement options if no patch becomes available within 90 days.

Autel MaxiCharger CVE-2026-8984

Q: What is the CVSS score of CVE-2026-8984?

CVE-2026-8984 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-46637 CRITICAL

Code Injection (CWE-94)

2026-07-21 CyberDanube

GHSA-9qpp-vgrg-5mhj

RCE Code Injection Maxicharger Single Autel

10.0

CVSS 4.0 · Vendor: CyberDanube

Severity by source

Vendor (CyberDanube) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated network-reachable RCE with no user interaction (AV:N/AC:L/PR:N/UI:N); root execution with impact beyond the service justifies S:C and full C/I/A loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:01 vuln.today

CVE Published

Jul 21, 2026 - 21:08 cve.org

CRITICAL 10.0

DescriptionCVE.org

Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.

AnalysisAI

Remote code execution in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets unauthenticated attackers run arbitrary code as root by sending a crafted request to the /test endpoint of a service listening on TCP port 9002. The flawed handler fetches, extracts, and executes attacker-supplied files, yielding full device takeover with no authentication or user interaction. Publicly available exploit code exists (published by CyberDanube) and the CVSS 4.0 score is 10.0; the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The affected component is the Autel MaxiCharger Single, a networked electric-vehicle charging station (EVSE) running embedded Linux firmware. A background network service bound to TCP port 9002 exposes a /test endpoint that, by design or misconfiguration, triggers a download-extract-execute workflow driven by attacker-supplied input. This maps to CWE-94 (Improper Control of Generation of Code / Code Injection): externally supplied data is incorporated into an executable code path without validation, so the attacker controls which files are retrieved and run. Because the service executes with root privileges, injected code inherits full control of the device. The single in-scope CPE, cpe:2.3:a:autel:maxicharger_single, identifies the product line, with all firmware versions up to and including V1.03.51 affected.

RemediationAI

No vendor-released patch identified at time of analysis, and no fixed firmware version appears in the input data, so operators should contact Autel and monitor for a firmware release superseding V1.03.51. As immediate compensating controls, block or firewall inbound access to TCP port 9002 on every charger and restrict device management to a trusted, segmented VLAN or VPN so the service is unreachable from the internet and general LAN clients - this directly removes the network path to the vulnerable /test handler with minimal operational impact, since port 9002 is not a customer-facing charging function. Where possible, front the chargers with a gateway that permits only required OCPP/charging traffic and drops all other ports, and monitor for unexpected outbound file downloads from chargers (a hallmark of successful exploitation). Review the CyberDanube writeup (https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/) for related issues on the same hardware. Trade-off: aggressive filtering may disrupt legitimate remote-management or diagnostic tooling that relies on device services, so validate before broad rollout.