13
CVEs
6
Critical
3
High
0
KEV
8
PoC
9
Unpatched C/H
0.0%
Patch Rate
0.7%
Avg EPSS
Severity Breakdown
CRITICAL
6
HIGH
3
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (12)
Maxicharger Ac Elite Business C50 Firmware
15
Maxicharger Dc Compact Mobile Firmware
10
Maxicharger Dc Compact Pedestal Firmware
10
Maxicharger Ac Pro Firmware
10
Maxicharger Single Charger Firmware
10
Maxicharger Ac Ultra Firmware
10
Maxicharger Dc Hipower Firmware
10
Maxicharger Dh480 Firmware
10
Maxicharger Dc Fast Firmware
10
Maxicharger Single
8
Maxicharger Ac Elite Home
5
Jwt Attack
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-8985 | Unauthenticated OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a remote attacker execute arbitrary operating-system commands by supplying crafted input in the 'url' parameter of the /test endpoint on TCP port 9002. The flaw scores CVSS 4.0 10.0 (maximum) with no authentication or user interaction required, and publicly available exploit code exists (research published by CyberDanube), though it is not yet listed in CISA KEV - no public exploit identified as actively exploited at time of analysis beyond the released POC. | CRITICAL | 10.0 | 4.2% | 74 |
PoC
No patch
|
| CVE-2026-8984 | Remote code execution in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets unauthenticated attackers run arbitrary code as root by sending a crafted request to the /test endpoint of a service listening on TCP port 9002. The flawed handler fetches, extracts, and executes attacker-supplied files, yielding full device takeover with no authentication or user interaction. Publicly available exploit code exists (published by CyberDanube) and the CVSS 4.0 score is 10.0; the vulnerability is not currently listed in CISA KEV. | CRITICAL | 10.0 | 0.5% | 71 |
PoC
No patch
|
| CVE-2026-8983 | Authentication bypass in Autel MaxiCharger Single EV charging stations running firmware up to and including V1.03.51 lets remote, unauthenticated attackers invoke privileged management endpoints by supplying a hard-coded token baked into the firmware. Because the token is static and shared across devices, anyone who extracts it once (publicly available exploit code exists via CyberDanube) can control the charger's management functions on any unpatched unit. The CVSS 4.0 base score is 10.0, and the flaw affords full compromise of the device with no user interaction. | CRITICAL | 10.0 | 0.3% | 70 |
PoC
No patch
|
| CVE-2026-8982 | Authentication bypass via hard-coded backdoor accounts in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets remote attackers gain administrative control of the web management interface. Two undocumented privileged accounts use a vendor-defined password derivation tied to device-specific values, so anyone who knows the algorithm and inputs can authenticate as admin without legitimate credentials. Publicly available exploit code exists (CyberDanube); no public evidence of active exploitation at time of analysis. | CRITICAL | 10.0 | 0.3% | 70 |
PoC
No patch
|
| CVE-2026-8986 | OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a malicious or compromised OCPP backend server inject arbitrary operating-system commands via the diagnostics URL parameter of an OCPP GetDiagnostics request. A rogue or hijacked charge-point management server can fully compromise the charger, and publicly available exploit code exists (CyberDanube), though no active exploitation has been confirmed. Because the impact reaches the underlying OS with full confidentiality, integrity, and availability loss, successful attacks give complete control of the charging hardware. | CRITICAL | 9.5 | 1.2% | 69 |
PoC
No patch
|
| CVE-2026-8987 | Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 stems from a heap-based buffer overflow in the set_ap_param command exposed by the /localcfg endpoint. An authenticated attacker who can reach the device's local configuration interface can send oversized input to crash the charger or potentially execute arbitrary code on it. Publicly available exploit code exists (published by CyberDanube), and the CVSS 4.0 base score is 9.4, though there is no evidence of active exploitation in the CISA KEV catalog at time of analysis. | CRITICAL | 9.4 | 0.4% | 67 |
PoC
No patch
|
| CVE-2026-8989 | Physical firmware compromise in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets an attacker with hands-on access exploit exposed NXP i.MX6 hardware recovery pins to boot unsigned, attacker-controlled code into memory. Once in recovery mode the attacker can dump, modify, or replace the device firmware and extract sensitive data such as credentials, keys, or configuration. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active campaigns and the flaw is not listed in CISA KEV. | HIGH | 8.6 | 0.2% | 63 |
PoC
No patch
|
| CVE-2026-8988 | Physical compromise of Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 is possible via an unprotected UART interface that lets an attacker halt boot and drop into the U-Boot bootloader. From the bootloader an attacker can rewrite boot configuration or the filesystem to gain full operating-system access on the charger. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active attacks and the flaw requires physical access. | HIGH | 8.6 | 0.1% | 63 |
PoC
No patch
|
| CVE-2026-13308 | Remote code execution in Autel MaxiCharger AC Elite Home EV chargers allows unauthenticated network attackers to run arbitrary code on the device by exploiting an integer underflow in the OCPP WebSocket message handler. The flaw stems from missing validation of user-supplied length/size data used in a buffer allocation, giving full compromise of the charger. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported privately through Zero Day Initiative (ZDI-26-437 / ZDI-CAN-29113). | HIGH | 8.1 | 0.6% | 41 |
No patch
|
| CVE-2026-13307 | Heap-based buffer overflow in Autel MaxiCharger AC Elite Home EV chargers enables arbitrary code execution by physically present, unauthenticated attackers via malformed USB packets. The device's USB packet handler copies attacker-controlled data into a fixed-length heap buffer without validating input length, allowing full control of device execution context. Reported by Zero Day Initiative (ZDI-CAN-29048 / ZDI-26-436); no public exploit code identified at time of analysis and not listed in CISA KEV. | MEDIUM | 6.8 | 0.3% | 34 |
No patch
|
| CVE-2026-13309 | Stack-based buffer overflow in the NFC card response handler of Autel MaxiCharger AC Elite Home EV chargers enables arbitrary code execution by a physically present attacker. The device's NFC interface fails to enforce bounds on a fixed-length stack buffer when processing card responses, allowing a maliciously crafted NFC card to overwrite stack memory and redirect execution flow to attacker-controlled code. No authentication is required to trigger the flaw - proximity to the device and a crafted NFC card are the sole prerequisites. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | MEDIUM | 6.8 | 0.2% | 34 |
No patch
|
| CVE-2026-13305 | Arbitrary code execution in Autel MaxiCharger AC Elite Home EV chargers is possible for physically present attackers who supply a crafted, unsigned or improperly signed firmware update image to the device. The flaw (CWE-347) stems from the absence of cryptographic signature validation during the software update process - tagged as a JWT attack vector - meaning the update mechanism accepts attacker-controlled images without verifying their authenticity. No public exploit has been identified at time of analysis, and exploitation requires physical proximity, but a successful attack achieves full code execution in the device context with high confidentiality, integrity, and availability impact. | MEDIUM | 6.4 | 0.1% | 32 |
No patch
|
| CVE-2026-13306 | Authentication bypass on the Autel MaxiCharger AC Elite Home EV charger allows physically present attackers to access device functionality without credentials via the exposed USB interface. The CWE-306 flaw represents a complete absence of authentication on the USB attack surface, not a weak implementation - any USB-connected party is immediately granted access. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; real-world risk is bounded by the physical access prerequisite inherent to the AV:P vector. | MEDIUM | 4.3 | 0.2% | 22 |
No patch
|