CVE-2026-8982
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web management interface with administrative privileges.
Risk Assessment
An attacker could gain full administrative control over the Autel Maxi Charger, potentially leading to manipulation of the charging process, data theft, or use of the device as an entry point into the network.
Recommendation
Update Autel Maxi Charger Single firmware to a version later than V1.03.51 and change default passwords.
Original NVD description (English source)
Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web management interface with administrative privileges.