Which versions of Autel MaxiCharger are affected by CVE-2026-8986?

Autel MaxiCharger Single EV charging stations (firmware v1.03.51 and earlier) contain a critical vulnerability allowing a compromised backend server to seize complete control of charging hardware.

Is there a public PoC exploit available for CVE-2026-8986?

Yes, a public proof-of-concept exploit is available for CVE-2026-8986. Prioritise patching immediately. EPSS: 1.2%.

How to fix or mitigate CVE-2026-8986?

Within 24 hours, immediately inventory all Autel MaxiCharger Single stations and confirm firmware versions to identify affected units (v1.03.51 and earlier), while documenting OCPP backend server configurations and network connectivity. Within 7 days, implement network segmentation to isolate affected chargers on dedicated subnets with firewall rules restricting OCPP communication to verified backend servers, enforce strong mutual authentication on OCPP connections, and contact Autel for patch timeline and interim hardening guidance. Within 30 days, deploy enhanced monitoring on OCPP backend communication to detect exploitation attempts, audit backend server access controls and enforce multi-factor authentication for administrative access, and evaluate temporary deactivation or replacement of affected chargers if patch timeline extends beyond 90 days.

Autel MaxiCharger CVE-2026-8986

Q: What is the CVSS score of CVE-2026-8986?

CVE-2026-8986 has a CVSS 4.0 base score of 9.5 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.2%.

EUVD-2026-46640 CRITICAL

OS Command Injection (CWE-78)

2026-07-21 CyberDanube

GHSA-pfm9-xrwg-mf3r

Command Injection Maxicharger Single Autel

9.5

CVSS 4.0 · Vendor: CyberDanube

Severity by source

Vendor (CyberDanube) PRIMARY

9.5 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.0 CRITICAL

Network-delivered via OCPP but AC:H because the attacker must first occupy the trusted OCPP-server role; S:C and full C/I/A as injected commands run on the charger OS.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:01 vuln.today

CVE Published

Jul 21, 2026 - 21:14 cve.org

CRITICAL 9.5

DescriptionCVE.org

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station.

AnalysisAI

OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a malicious or compromised OCPP backend server inject arbitrary operating-system commands via the diagnostics URL parameter of an OCPP GetDiagnostics request. A rogue or hijacked charge-point management server can fully compromise the charger, and publicly available exploit code exists (CyberDanube), though no active exploitation has been confirmed. Because the impact reaches the underlying OS with full confidentiality, integrity, and availability loss, successful attacks give complete control of the charging hardware.

Technical ContextAI

The vulnerability lives in the charger's implementation of OCPP (Open Charge Point Protocol), the standard WebSocket/HTTP-based protocol EV chargers use to talk to a central management system. The OCPP GetDiagnostics operation instructs a charger to upload diagnostic logs to a URL supplied by the server; here the firmware passes that attacker-influenced URL into an OS-level command (e.g., a shell invocation of an upload/transfer utility) without sanitization, matching CWE-78 (Improper Neutralization of Special Elements used in an OS Command). CPE cpe:2.3:a:autel:maxicharger_single identifies the affected product line; all firmware revisions up to and including V1.03.51 are indicated as vulnerable. The root cause is trust of a protocol field that is treated as a benign parameter but is concatenated into a command string executed on the embedded Linux-class controller.

RemediationAI

No vendor-released patched firmware version is identified at time of analysis, so operators should treat mitigation as primary: update to any Autel-provided firmware newer than V1.03.51 as soon as the vendor publishes one and monitor the CyberDanube advisory (https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/) and Autel channels for a release. In the meantime, ensure the charger only connects to a trusted OCPP backend over authenticated TLS (OCPP-J over wss:// with certificate validation) to prevent rogue-server and man-in-the-middle scenarios; isolate chargers on a dedicated network segment or VPN so their OCPP endpoint is not reachable from untrusted networks; and restrict/harden the charge-point management server itself, since its compromise directly yields charger compromise. Trade-off: enforcing strict TLS/mutual auth and network isolation may break connectivity with permissive or legacy OCPP backends and complicate remote diagnostics, so validate backend compatibility before enforcing.