Which versions of Maxicharger Single are affected by EUVD-2026-46643?

Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 contain a critical remote code execution vulnerability accessible to authenticated users on the local configuration…

Is there a public PoC exploit available for EUVD-2026-46643?

Yes, a public proof-of-concept exploit is available for EUVD-2026-46643. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2026-46643?

Within 24 hours: Identify all Autel MaxiCharger Single units in operation and verify current firmware versions; restrict network access to the /localcfg endpoint to authorized personnel only using firewall rules or network segmentation. Within 7 days: Complete inventory assessment, implement multi-factor authentication for configuration access, and deploy monitoring to detect exploitation attempts against the /localcfg endpoint. Within 30 days: Establish continuous monitoring for Autel security advisories and firmware patches; develop and test an update deployment plan to apply patches immediately upon release; evaluate network architecture changes to isolate charger management from general corporate networks.

Maxicharger Single EUVD-2026-46643

Q: What is the CVSS score of EUVD-2026-46643?

EUVD-2026-46643 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-8987 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-07-21 CyberDanube

GHSA-qh3x-7q6p-6x7f

RCE Buffer Overflow Denial Of Service Heap Overflow Maxicharger Single Autel

9.4

CVSS 4.0 · Vendor: CyberDanube

Severity by source

Vendor (CyberDanube) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CyberDanube) · only source for this CVE.

CVSS VectorVendor: CyberDanube

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:04 vuln.today

CVE Published

Jul 21, 2026 - 21:18 cve.org

CRITICAL 9.4

DescriptionCVE.org

Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentially arbitrary code execution.

AnalysisAI

Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 stems from a heap-based buffer overflow in the set_ap_param command exposed by the /localcfg endpoint. An authenticated attacker who can reach the device's local configuration interface can send oversized input to crash the charger or potentially execute arbitrary code on it. Publicly available exploit code exists (published by CyberDanube), and the CVSS 4.0 base score is 9.4, though there is no evidence of active exploitation in the CISA KEV catalog at time of analysis.