CVE-2026-8985
CriticalCVSS 10.0Exploitation Probability (EPSS)
High risk90th percentile - higher than 90% of all known CVEs
Summary
Autel Maxi Charger Single firmware up to version V1.03.51 is vulnerable to OS command injection via the /test endpoint on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary system commands.
Risk Assessment
An attacker can remotely take control of the charger, potentially causing hardware damage or data theft.
Recommendation
Immediately update the firmware to a version later than V1.03.51 and restrict access to port 9002 to trusted networks only.
Original NVD description (English source)
Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.