Which versions of Autel MaxiCharger are affected by CVE-2026-8985?

Autel MaxiCharger Single EV charging stations (firmware ≤V1.03.51) are vulnerable to unauthenticated remote command execution via a crafted request to the /test endpoint, allowing attackers to seize…

Is there a public PoC exploit available for CVE-2026-8985?

Yes, a public proof-of-concept exploit is available for CVE-2026-8985. Prioritise patching immediately. EPSS: 4.2%.

How to fix or mitigate CVE-2026-8985?

Within 24 hours: Inventory all Autel MaxiCharger Single units in production and identify their firmware versions; immediately restrict network access to TCP port 9002 via firewall rules, limiting connections to authorized administrative networks only. Within 7 days: Deploy network segmentation to isolate charging stations from sensitive systems; enable comprehensive logging of /test endpoint requests and monitor for anomalous patterns; contact Autel support to confirm patch timeline. Within 30 days: Apply any vendor-released firmware patch immediately upon availability (confirm version ≥V1.03.52 or later when released); conduct forensic review of affected stations for evidence of prior compromise; update incident response runbooks to reflect charging infrastructure as a critical asset.

Autel MaxiCharger CVE-2026-8985

Q: What is the CVSS score of CVE-2026-8985?

CVE-2026-8985 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 4.2%.

EUVD-2026-46639 CRITICAL

OS Command Injection (CWE-78)

2026-07-21 CyberDanube

GHSA-g3wx-h3f8-c23p

Command Injection Maxicharger Single Autel

10.0

CVSS 4.0 · Vendor: CyberDanube

Severity by source

Vendor (CyberDanube) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Remote unauthenticated command injection with low complexity (AV:N/AC:L/PR:N/UI:N); OS-level execution on an embedded device fully compromises confidentiality, integrity and availability, with S:C reflecting impact beyond the vulnerable service.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:01 vuln.today

CVE Published

Jul 21, 2026 - 21:11 cve.org

CRITICAL 10.0

DescriptionCVE.org

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

AnalysisAI

Unauthenticated OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a remote attacker execute arbitrary operating-system commands by supplying crafted input in the 'url' parameter of the /test endpoint on TCP port 9002. The flaw scores CVSS 4.0 10.0 (maximum) with no authentication or user interaction required, and publicly available exploit code exists (research published by CyberDanube), though it is not yet listed in CISA KEV - no public exploit identified as actively exploited at time of analysis beyond the released POC.

Technical ContextAI

The affected device is an Autel MaxiCharger Single, a networked electric-vehicle AC/DC charging station. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-controlled data from the 'url' parameter is passed into a shell or command interpreter without adequate sanitization or neutralization. The exposed service listens on TCP port 9002 and offers a /test endpoint that appears intended for diagnostic or connectivity testing; the 'url' value is evidently concatenated into an OS-level command (e.g. a network fetch/ping style operation), allowing shell metacharacters to break out and run attacker-chosen commands. The affected component is identified by CPE cpe:2.3:a:autel:maxicharger_single:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch or fixed firmware version is identified in the available data at time of analysis; the only reference is the CyberDanube research advisory at https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/, so operators should consult Autel directly for updated firmware superseding V1.03.51. As specific compensating controls, restrict network access to TCP port 9002 by placing chargers on an isolated management/OT VLAN and blocking port 9002 at the network boundary so the /test endpoint is not reachable from untrusted networks or the internet (trade-off: may disrupt legitimate remote diagnostics or management tooling that relies on that service); apply strict firewall allow-listing so only known management hosts can reach the device; and monitor port 9002 traffic for anomalous requests to /test. These are mitigations only and do not remove the underlying command-injection flaw, which requires a firmware fix from the vendor.