CVE-2026-8984

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 13/08/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

41th percentile - higher than 41% of all known CVEs

Summary

Autel Maxi Charger Single firmware up to version V1.03.51 has an unauthenticated remote code execution vulnerability via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.

Risk Assessment

An unauthenticated attacker can fully compromise the device, potentially leading to network and data security breaches.

Recommendation

Update Autel Maxi Charger Single firmware to the latest version that fixes this issue.

Other vulnerabilities in Autel Maxi Charger Single firmware

CVE-2026-8983Critical
Autel Maxi Charger Single firmware up to version V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can use this token to invoke privileged functionality without valid authentication.

Original NVD description (English source)

Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.