Skip to main content

Autel MaxiCharger CVE-2026-8985

| EUVDEUVD-2026-46639 CRITICAL
OS Command Injection (CWE-78)
2026-07-21 CyberDanube GHSA-g3wx-h3f8-c23p
Command Injection Maxicharger Single
10.0
CVSS 4.0 · Vendor: CyberDanube
Share

Severity by source

Vendor (CyberDanube) PRIMARY
10.0 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
10.0 CRITICAL

Remote unauthenticated command injection with low complexity (AV:N/AC:L/PR:N/UI:N); OS-level execution on an embedded device fully compromises confidentiality, integrity and availability, with S:C reflecting impact beyond the vulnerable service.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 21, 2026 - 22:01 vuln.today
CVE Published
Jul 21, 2026 - 21:11 cve.org
CRITICAL 10.0

DescriptionCVE.org

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

AnalysisAI

Unauthenticated OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a remote attacker execute arbitrary operating-system commands by supplying crafted input in the 'url' parameter of the /test endpoint on TCP port 9002. The flaw scores CVSS 4.0 10.0 (maximum) with no authentication or user interaction required, and publicly available exploit code exists (research published by CyberDanube), though it is not yet listed in CISA KEV - no public exploit identified as actively exploited at time of analysis beyond the released POC.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach charger on TCP port 9002
Delivery
Send crafted /test request with malicious url parameter
Exploit
Break out via shell metacharacters
Execution
Execute arbitrary OS commands
Impact
Backdoor device and pivot to network
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The exact requirement is network reachability to the /test endpoint served over TCP port 9002 on an Autel MaxiCharger Single running firmware through V1.03.51, with a crafted payload placed in the 'url' HTTP parameter - no authentication, no user interaction, and no special non-default configuration are required per the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine top-priority issue, not a high-score-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach the charger over the network connects to TCP port 9002 and sends a crafted HTTP request to the /test endpoint with shell metacharacters injected into the 'url' parameter, causing the device to execute arbitrary OS commands. Because public exploit code exists (CyberDanube) and no authentication is required, the attacker can gain command execution to install a backdoor, pivot into the connected network, or manipulate charging operations. …
Remediation No vendor-released patch or fixed firmware version is identified in the available data at time of analysis; the only reference is the CyberDanube research advisory at https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/, so operators should consult Autel directly for updated firmware superseding V1.03.51. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all Autel MaxiCharger Single units in production and identify their firmware versions; immediately restrict network access to TCP port 9002 via firewall rules, limiting connections to authorized administrative networks only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Maxicharger Single

View all
CVE-2026-8984 CRITICAL POC
10.0 Jul 21

Remote code execution in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets unauthenticated

CVE-2026-8983 CRITICAL POC
10.0 Jul 21

Authentication bypass in Autel MaxiCharger Single EV charging stations running firmware up to and including V1.03.51 let
CVE-2026-8982 CRITICAL POC
10.0 Jul 21

Authentication bypass via hard-coded backdoor accounts in Autel MaxiCharger Single EV charging stations (firmware throug
CVE-2026-8986 CRITICAL POC
9.5 Jul 21

OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a malicious or co
CVE-2026-8987 CRITICAL POC
9.4 Jul 21

Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1
CVE-2026-8989 HIGH POC
8.6 Jul 21

Physical firmware compromise in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets an attack
CVE-2026-8988 HIGH POC
8.6 Jul 21

Physical compromise of Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 is possible via a

Same weakness CWE-78 – OS Command Injection

View all
CVE-2014-6271 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6
CVE-2014-7169 CRITICAL POC
9.8
CVE-2017-6884 HIGH POC
8.8
CVE-2017-6077 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6

Share

CVE-2026-8985 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy