Skip to main content

Autel MaxiCharger CVE-2026-8984

| EUVDEUVD-2026-46637 CRITICAL
Code Injection (CWE-94)
2026-07-21 CyberDanube GHSA-9qpp-vgrg-5mhj
Code Injection RCE Maxicharger Single
10.0
CVSS 4.0 · Vendor: CyberDanube
Share

Severity by source

Vendor (CyberDanube) PRIMARY
10.0 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
10.0 CRITICAL

Unauthenticated network-reachable RCE with no user interaction (AV:N/AC:L/PR:N/UI:N); root execution with impact beyond the service justifies S:C and full C/I/A loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 21, 2026 - 22:01 vuln.today
CVE Published
Jul 21, 2026 - 21:08 cve.org
CRITICAL 10.0

DescriptionCVE.org

Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.

AnalysisAI

Remote code execution in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets unauthenticated attackers run arbitrary code as root by sending a crafted request to the /test endpoint of a service listening on TCP port 9002. The flawed handler fetches, extracts, and executes attacker-supplied files, yielding full device takeover with no authentication or user interaction. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach charger TCP port 9002
Delivery
Send crafted request to /test endpoint
Exploit
Device downloads attacker-controlled files
Execution
Extract and execute payload as root
Impact
Full device takeover and network pivot
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network reachability to the service listening on TCP port 9002 and the ability to send a crafted request to its /test endpoint; no authentication (PR:N), no user interaction (UI:N), and no special attack requirements (AT:N) are needed against affected firmware (through V1.03.51). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine top-priority issue, not an inflated high-CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach a charger's TCP port 9002 - an internet-exposed unit or a malicious host on the same network - sends a crafted request to the /test endpoint referencing an attacker-hosted payload. The charger downloads, extracts, and executes that payload as root, and because public exploit code exists, the attacker gains full device control to disrupt charging, pivot into the network, or conscript the unit into a botnet with minimal effort.
Remediation No vendor-released patch identified at time of analysis, and no fixed firmware version appears in the input data, so operators should contact Autel and monitor for a firmware release superseding V1.03.51. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: identify all Autel MaxiCharger Single units in operation and audit firmware versions through V1.03.51; implement network access controls to restrict external connectivity to TCP port 9002 if operationally feasible. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Maxicharger Single

View all
CVE-2026-8985 CRITICAL POC
10.0 Jul 21

Unauthenticated OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a
CVE-2026-8983 CRITICAL POC
10.0 Jul 21

Authentication bypass in Autel MaxiCharger Single EV charging stations running firmware up to and including V1.03.51 let
CVE-2026-8982 CRITICAL POC
10.0 Jul 21

Authentication bypass via hard-coded backdoor accounts in Autel MaxiCharger Single EV charging stations (firmware throug
CVE-2026-8986 CRITICAL POC
9.5 Jul 21

OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a malicious or co
CVE-2026-8987 CRITICAL POC
9.4 Jul 21

Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1
CVE-2026-8989 HIGH POC
8.6 Jul 21

Physical firmware compromise in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets an attack
CVE-2026-8988 HIGH POC
8.6 Jul 21

Physical compromise of Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 is possible via a

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8

Share

CVE-2026-8984 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy