Which versions of Autel MaxiCharger are affected by CVE-2026-8988?

Autel MaxiCharger Single charging stations are exposed to complete operating system compromise if an attacker gains physical access to the device hardware.

Is there a public PoC exploit available for CVE-2026-8988?

Yes, a public proof-of-concept exploit is available for CVE-2026-8988. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-8988?

Within 24 hours, conduct an inventory of all Autel MaxiCharger Single stations running firmware through V1.03.51 and assess the physical security posture of each location. Within 7 days, implement compensating controls including restricted physical access through facility locks and camera surveillance, tamper-evident seals on devices, documented maintenance access protocols, and logging of all hardware-level access and modifications. Within 30 days, contact Autel directly for patch availability and firmware update timelines; establish a mandatory update procedure for when patches are released; and evaluate replacement options for any stations in high-risk locations where adequate physical security cannot be implemented.

Autel MaxiCharger CVE-2026-8988

Q: What is the CVSS score of CVE-2026-8988?

CVE-2026-8988 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-46437 HIGH

On-Chip Debug and Test Interface With Improper Access Control (CWE-1191)

2026-07-21 CyberDanube

GHSA-qpg5-v459-hjvj

Information Disclosure Maxicharger Single Autel

8.6

CVSS 4.0 · Vendor: CyberDanube

Severity by source

Vendor (CyberDanube) PRIMARY

8.6 HIGH

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Physical UART access with no auth or interaction (AV:P/PR:N/UI:N); bootloader compromise crosses from boot to OS trust boundary giving S:C and full C/I/A:H.

3.1 AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:04 vuln.today

CVE Published

Jul 21, 2026 - 21:21 cve.org

HIGH 8.6

DescriptionCVE.org

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An attacker with physical access can modify the boot configuration or file system to obtain operating system access.

AnalysisAI

Physical compromise of Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 is possible via an unprotected UART interface that lets an attacker halt boot and drop into the U-Boot bootloader. From the bootloader an attacker can rewrite boot configuration or the filesystem to gain full operating-system access on the charger. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active attacks and the flaw requires physical access.

Technical ContextAI

The affected component is the embedded Linux/U-Boot boot chain on the Autel MaxiCharger Single, an AC/DC electric-vehicle charging station (CPE cpe:2.3:a:autel:maxicharger_single). The root cause is CWE-1191 (exposed on-chip debug/test interface with improper access control): a serial UART console remains active and unauthenticated on the board, and U-Boot is configured to allow interruption of the automatic boot sequence (typically by sending a keystroke during the countdown). Because U-Boot runs before any OS-level access controls, an attacker at the console can alter kernel boot arguments (e.g., inject an init=/bin/sh or single-user parameter), load alternative images, or mount and modify the root filesystem, bypassing whatever authentication the running firmware would normally enforce.

RemediationAI

No vendor-released patch version is identified at time of analysis, so remediation centers on physical and boot-chain hardening: consult the CyberDanube advisory (https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/) and Autel for firmware updates, and apply any fixed firmware once released. As compensating controls, disable or password-protect the U-Boot console (set a CONFIG_AUTOBOOT_KEYED/bootstop password and non-interruptible boot delay) so the boot sequence cannot be halted from serial; physically block or remove the exposed UART header and use tamper-evident enclosures or security screws to detect and deter case opening; and restrict physical access to the charging unit's internal board (locked enclosures, siting in monitored/CCTV-covered locations). The trade-off of locking the U-Boot console is loss of field-debug/recovery convenience for technicians, and tamper enclosures add servicing overhead - but these are the only meaningful mitigations for a physical UART/bootloader flaw until patched firmware is available.