Skip to main content

Autel MaxiCharger CVE-2026-8986

| EUVDEUVD-2026-46640 CRITICAL
OS Command Injection (CWE-78)
2026-07-21 CyberDanube GHSA-pfm9-xrwg-mf3r
Command Injection Maxicharger Single
9.5
CVSS 4.0 · Vendor: CyberDanube
Share

Severity by source

Vendor (CyberDanube) PRIMARY
9.5 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.0 CRITICAL

Network-delivered via OCPP but AC:H because the attacker must first occupy the trusted OCPP-server role; S:C and full C/I/A as injected commands run on the charger OS.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 21, 2026 - 22:01 vuln.today
CVE Published
Jul 21, 2026 - 21:14 cve.org
CRITICAL 9.5

DescriptionCVE.org

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station.

AnalysisAI

OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a malicious or compromised OCPP backend server inject arbitrary operating-system commands via the diagnostics URL parameter of an OCPP GetDiagnostics request. A rogue or hijacked charge-point management server can fully compromise the charger, and publicly available exploit code exists (CyberDanube), though no active exploitation has been confirmed. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain OCPP server position (rogue/compromised/MITM)
Delivery
Send crafted GetDiagnostics request
Exploit
Inject shell metacharacters in diagnostics URL
Execution
Charger executes OS command
Impact
Full control of charging station
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to control the OCPP server side of the charger's connection - either by operating a malicious OCPP backend, compromising the legitimate charge-point management server, or man-in-the-middling an OCPP session that lacks TLS/mutual authentication - and then sending a GetDiagnostics request with a crafted diagnostics URL containing OS command-injection payload. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score is 9.5 (AV:N/AC:L/AT:P/PR:N/UI:N with high impact to both the vulnerable system and subsequent systems), reflecting network reachability, low complexity, and total compromise - but the AT:P (attack requirement present) metric is the crux: exploitation is not against an arbitrary anonymous attacker but requires the adversary to occupy the position of the charger's OCPP server, either by operating a malicious backend, compromising the legitimate one, or performing a man-in-the-middle on an unauthenticated/weakly-authenticated OCPP session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who stands up a rogue OCPP server, compromises the legitimate charge-point management platform, or intercepts an unauthenticated OCPP session sends a GetDiagnostics request whose diagnostics URL embeds shell metacharacters and an attacker command. The charger parses the request and executes the injected command on its OS, giving the attacker code execution on the charging station; a public POC from CyberDanube demonstrates the technique, and the low attack complexity means it can be triggered with a single crafted message once server position is achieved.
Remediation No vendor-released patched firmware version is identified at time of analysis, so operators should treat mitigation as primary: update to any Autel-provided firmware newer than V1.03.51 as soon as the vendor publishes one and monitor the CyberDanube advisory (https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/) and Autel channels for a release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, immediately inventory all Autel MaxiCharger Single stations and confirm firmware versions to identify affected units (v1.03.51 and earlier), while documenting OCPP backend server configurations and network connectivity. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Maxicharger Single

View all
CVE-2026-8985 CRITICAL POC
10.0 Jul 21

Unauthenticated OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a
CVE-2026-8984 CRITICAL POC
10.0 Jul 21

Remote code execution in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets unauthenticated

CVE-2026-8983 CRITICAL POC
10.0 Jul 21

Authentication bypass in Autel MaxiCharger Single EV charging stations running firmware up to and including V1.03.51 let
CVE-2026-8982 CRITICAL POC
10.0 Jul 21

Authentication bypass via hard-coded backdoor accounts in Autel MaxiCharger Single EV charging stations (firmware throug
CVE-2026-8987 CRITICAL POC
9.4 Jul 21

Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1
CVE-2026-8989 HIGH POC
8.6 Jul 21

Physical firmware compromise in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets an attack
CVE-2026-8988 HIGH POC
8.6 Jul 21

Physical compromise of Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 is possible via a

Same weakness CWE-78 – OS Command Injection

View all
CVE-2014-6271 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6
CVE-2014-7169 CRITICAL POC
9.8
CVE-2017-6884 HIGH POC
8.8
CVE-2017-6077 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2025-64328 HIGH POC
8.6

Share

CVE-2026-8986 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy