28
CVEs
6
Critical
14
High
0
KEV
8
PoC
20
Unpatched C/H
0.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
6
HIGH
14
MEDIUM
8
LOW
0
Monthly CVE Trend
Affected Products (12)
Maxicharger Ac Elite Business C50 Firmware
15
Maxicharger Dc Compact Mobile Firmware
10
Maxicharger Dc Compact Pedestal Firmware
10
Maxicharger Ac Pro Firmware
10
Maxicharger Single Charger Firmware
10
Maxicharger Ac Ultra Firmware
10
Maxicharger Dc Hipower Firmware
10
Maxicharger Dh480 Firmware
10
Maxicharger Dc Fast Firmware
10
Maxicharger Single
8
Maxicharger Ac Elite Home
5
Jwt Attack
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-8985 | Unauthenticated OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a remote attacker execute arbitrary operating-system commands by supplying crafted input in the 'url' parameter of the /test endpoint on TCP port 9002. The flaw scores CVSS 4.0 10.0 (maximum) with no authentication or user interaction required, and publicly available exploit code exists (research published by CyberDanube), though it is not yet listed in CISA KEV - no public exploit identified as actively exploited at time of analysis beyond the released POC. | CRITICAL | 10.0 | 4.2% | 74 |
PoC
No patch
|
| CVE-2026-8984 | Remote code execution in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets unauthenticated attackers run arbitrary code as root by sending a crafted request to the /test endpoint of a service listening on TCP port 9002. The flawed handler fetches, extracts, and executes attacker-supplied files, yielding full device takeover with no authentication or user interaction. Publicly available exploit code exists (published by CyberDanube) and the CVSS 4.0 score is 10.0; the vulnerability is not currently listed in CISA KEV. | CRITICAL | 10.0 | 0.5% | 71 |
PoC
No patch
|
| CVE-2026-8983 | Authentication bypass in Autel MaxiCharger Single EV charging stations running firmware up to and including V1.03.51 lets remote, unauthenticated attackers invoke privileged management endpoints by supplying a hard-coded token baked into the firmware. Because the token is static and shared across devices, anyone who extracts it once (publicly available exploit code exists via CyberDanube) can control the charger's management functions on any unpatched unit. The CVSS 4.0 base score is 10.0, and the flaw affords full compromise of the device with no user interaction. | CRITICAL | 10.0 | 0.3% | 70 |
PoC
No patch
|
| CVE-2026-8982 | Authentication bypass via hard-coded backdoor accounts in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets remote attackers gain administrative control of the web management interface. Two undocumented privileged accounts use a vendor-defined password derivation tied to device-specific values, so anyone who knows the algorithm and inputs can authenticate as admin without legitimate credentials. Publicly available exploit code exists (CyberDanube); no public evidence of active exploitation at time of analysis. | CRITICAL | 10.0 | 0.3% | 70 |
PoC
No patch
|
| CVE-2026-8986 | OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a malicious or compromised OCPP backend server inject arbitrary operating-system commands via the diagnostics URL parameter of an OCPP GetDiagnostics request. A rogue or hijacked charge-point management server can fully compromise the charger, and publicly available exploit code exists (CyberDanube), though no active exploitation has been confirmed. Because the impact reaches the underlying OS with full confidentiality, integrity, and availability loss, successful attacks give complete control of the charging hardware. | CRITICAL | 9.5 | 1.2% | 69 |
PoC
No patch
|
| CVE-2026-8987 | Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 stems from a heap-based buffer overflow in the set_ap_param command exposed by the /localcfg endpoint. An authenticated attacker who can reach the device's local configuration interface can send oversized input to crash the charger or potentially execute arbitrary code on it. Publicly available exploit code exists (published by CyberDanube), and the CVSS 4.0 base score is 9.4, though there is no evidence of active exploitation in the CISA KEV catalog at time of analysis. | CRITICAL | 9.4 | 0.4% | 67 |
PoC
No patch
|
| CVE-2026-8989 | Physical firmware compromise in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets an attacker with hands-on access exploit exposed NXP i.MX6 hardware recovery pins to boot unsigned, attacker-controlled code into memory. Once in recovery mode the attacker can dump, modify, or replace the device firmware and extract sensitive data such as credentials, keys, or configuration. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active campaigns and the flaw is not listed in CISA KEV. | HIGH | 8.6 | 0.2% | 63 |
PoC
No patch
|
| CVE-2026-8988 | Physical compromise of Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 is possible via an unprotected UART interface that lets an attacker halt boot and drop into the U-Boot bootloader. From the bootloader an attacker can rewrite boot configuration or the filesystem to gain full operating-system access on the charger. Publicly available exploit code exists (published by CyberDanube), though there is no public exploit identified as being used in active attacks and the flaw requires physical access. | HIGH | 8.6 | 0.1% | 63 |
PoC
No patch
|
| CVE-2025-5827 | CVE-2025-5827 is a stack-based buffer overflow vulnerability in the ble_process_esp32_msg function of Autel MaxiCharger AC Wallbox Commercial EV chargers that allows unauthenticated, network-adjacent attackers to execute arbitrary code with high impact. The vulnerability results from insufficient validation of user-supplied data length before copying to a fixed-size stack buffer, affecting commercial EV charging infrastructure without requiring authentication or user interaction. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2025-5830 | CVE-2025-5830 is a heap-based buffer overflow vulnerability in Autel MaxiCharger AC Wallbox Commercial EV chargers affecting the DLB_SlaveRegister message handler. Network-adjacent attackers can execute arbitrary code without authentication due to insufficient input validation on user-supplied data length before copying to a fixed-length buffer. This is a critical vulnerability affecting critical infrastructure (EV charging stations) with a CVSS score of 8.8 and high real-world exploitability due to the unauthenticated, network-adjacent attack vector. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2025-5822 | CVE-2025-5822 is a privilege escalation vulnerability in the Autel MaxiCharger AC Wallbox Commercial Technician API that allows authenticated attackers to escalate from low-privileged users to higher privilege levels, potentially gaining unauthorized access to administrative functions and sensitive charging station data. The vulnerability requires an attacker to first obtain a valid low-privileged API token, after which they can bypass authorization controls to access restricted resources. With a CVSS score of 8.8 and network-accessible attack vector, this represents a significant risk to commercial EV charging infrastructure. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2024-7795 | Autel MaxiCharger AC Elite Business C50 AppAuthenExchangeRandomNum Stack-Based Buffer Overflow Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.5% | 44 |
No patch
|
| CVE-2024-23957 | Autel MaxiCharger AC Elite Business C50 DLB_HostHeartBeat Stack-based Buffer Overflow Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.8 | 1.0% | 44 |
No patch
|
| CVE-2024-23958 | Autel MaxiCharger AC Elite Business C50 BLE Hardcoded Credentials Authentication Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.8% | 44 |
No patch
|
| CVE-2026-13308 | Remote code execution in Autel MaxiCharger AC Elite Home EV chargers allows unauthenticated network attackers to run arbitrary code on the device by exploiting an integer underflow in the OCPP WebSocket message handler. The flaw stems from missing validation of user-supplied length/size data used in a buffer allocation, giving full compromise of the charger. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported privately through Zero Day Initiative (ZDI-26-437 / ZDI-CAN-29113). | HIGH | 8.1 | 0.6% | 41 |
No patch
|