Autel MaxiCharger CVE-2026-8984

Exploitation requires network reachability to the service listening on TCP port 9002 and the ability to send a crafted request to its /test endpoint; no authentication (PR:N), no user interaction (UI:N), and no special attack requirements (AT:N) are needed against affected firmware (through V1.03.51). The primary limiting factor is network exposure of port 9002 - if that service is not reachable by the attacker (blocked at a firewall or isolated on a segmented network), exploitation is prevented. The attacker must also be able to host or reference files the device will fetch and execute, so outbound network access from the charger to attacker-controlled infrastructure is part of the required chain.

This is a genuine top-priority issue, not an inflated high-CVSS number. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high impact to both the vulnerable system VC/VI/VA and subsequent systems SC/SI/SA) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction - the maximum-severity profile, scoring 10.0. Publicly available exploit code from CyberDanube sharply lowers the barrier to real-world attacks. Tempering the urgency: no EPSS score was provided in the input, and the CVE is not listed in CISA KEV, so there is no confirmation of active in-the-wild exploitation at time of analysis - POC availability and active exploitation are distinct signals. Real exposure hinges on network reachability of port 9002: chargers exposed to the internet or an untrusted LAN face severe risk, while units behind strict segmentation face materially reduced practical risk. No signals conflict - the description (unauthenticated network RCE) is fully consistent with the AV:N/PR:N vector.

An attacker who can reach a charger's TCP port 9002 - an internet-exposed unit or a malicious host on the same network - sends a crafted request to the /test endpoint referencing an attacker-hosted payload. The charger downloads, extracts, and executes that payload as root, and because public exploit code exists, the attacker gains full device control to disrupt charging, pivot into the network, or conscript the unit into a botnet with minimal effort.