CVE-2026-8983

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 12/08/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

Autel Maxi Charger Single firmware up to version V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can use this token to invoke privileged functionality without valid authentication.

Risk Assessment

High risk – an attacker can gain unauthorized access to charger management functions, potentially leading to device manipulation or disruption.

Recommendation

Update the firmware to the latest version that removes the hard-coded token. If no update is available, restrict network access to the device.

Other vulnerabilities in Autel Maxi Charger Single firmware

CVE-2026-8984Critical
Autel Maxi Charger Single firmware up to version V1.03.51 has an unauthenticated remote code execution vulnerability via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.

Original NVD description (English source)

Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to invoke privileged functionality without valid authentication.