Autel MaxiCharger EUVD-2026-46639

The exact requirement is network reachability to the /test endpoint served over TCP port 9002 on an Autel MaxiCharger Single running firmware through V1.03.51, with a crafted payload placed in the 'url' HTTP parameter - no authentication, no user interaction, and no special non-default configuration are required per the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N). The only meaningful limiting factor is network exposure: the attacker must be able to route to TCP port 9002, so devices isolated on segmented management networks or behind a firewall blocking that port are not remotely exploitable, whereas any charger with port 9002 exposed to an untrusted network is exploitable by default.

This is a genuine top-priority issue, not a high-score-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high vulnerable- and subsequent-system impact across VC/VI/VA/SC/SI/SA) describes remote, network-reachable, unauthenticated, low-complexity exploitation with full compromise - corroborated by the CWE-78 command-injection class and the existence of public exploit code from CyberDanube. Every available signal aligns toward high real-world risk: no privilege or user-interaction barrier, trivial exploit complexity, and a working POC. The principal uncertainty is exposure scope: exploitation requires network reachability to TCP port 9002, so risk in practice depends on whether the charger's management interface is exposed to hostile networks or the internet versus isolated on a segmented OT/management VLAN. No EPSS score and no SSVC decision data were provided in the input, and the vulnerability is not in CISA KEV, so there is no confirmation of active in-the-wild exploitation - the elevated risk rests on POC availability plus maximal CVSS, not observed attacks.

An attacker who can reach the charger over the network connects to TCP port 9002 and sends a crafted HTTP request to the /test endpoint with shell metacharacters injected into the 'url' parameter, causing the device to execute arbitrary OS commands. Because public exploit code exists (CyberDanube) and no authentication is required, the attacker can gain command execution to install a backdoor, pivot into the connected network, or manipulate charging operations. The low attack complexity and network attack vector make this reliably repeatable against any exposed device.