Which versions of Maxicharger Single are affected by CVE-2026-8987?

Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 contain a critical remote code execution vulnerability accessible to authenticated users on the local configuration…

Is there a public PoC exploit available for CVE-2026-8987?

Yes, a public proof-of-concept exploit is available for CVE-2026-8987. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-8987?

Within 24 hours: Identify all Autel MaxiCharger Single units in operation and verify current firmware versions; restrict network access to the /localcfg endpoint to authorized personnel only using firewall rules or network segmentation. Within 7 days: Complete inventory assessment, implement multi-factor authentication for configuration access, and deploy monitoring to detect exploitation attempts against the /localcfg endpoint. Within 30 days: Establish continuous monitoring for Autel security advisories and firmware patches; develop and test an update deployment plan to apply patches immediately upon release; evaluate network architecture changes to isolate charger management from general corporate networks.

Maxicharger Single CVE-2026-8987

Q: What is the CVSS score of CVE-2026-8987?

CVE-2026-8987 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-46643 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-07-21 CyberDanube

GHSA-qh3x-7q6p-6x7f

RCE Denial Of Service Heap Overflow Buffer Overflow Maxicharger Single

9.4

CVSS 4.0 · Vendor: CyberDanube

Severity by source

Vendor (CyberDanube) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CyberDanube) · only source for this CVE.

CVSS VectorVendor: CyberDanube

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:04 vuln.today

CVE Published

Jul 21, 2026 - 21:18 cve.org

CRITICAL 9.4

DescriptionCVE.org

Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentially arbitrary code execution.

AnalysisAI

Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 stems from a heap-based buffer overflow in the set_ap_param command exposed by the /localcfg endpoint. An authenticated attacker who can reach the device's local configuration interface can send oversized input to crash the charger or potentially execute arbitrary code on it. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Identify all Autel MaxiCharger Single units in operation and verify current firmware versions; restrict network access to the /localcfg endpoint to authorized personnel only using firewall rules or network segmentation. …

Threat intelligence, references, and detailed analysis are available after sign-in.