CVE-2026-8984
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Autel Maxi Charger Single firmware up to version V1.03.51 has an unauthenticated remote code execution vulnerability via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.
Risk Assessment
An unauthenticated attacker can fully compromise the device, potentially leading to network and data security breaches.
Recommendation
Update Autel Maxi Charger Single firmware to the latest version that fixes this issue.
Original NVD description (English source)
Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.