CVE-2026-8986
CriticalCVSS 9.5Exploitation Probability (EPSS)
Elevated risk65th percentile - higher than 65% of all known CVEs
Summary
Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station.
Risk Assessment
An attacker can remotely execute arbitrary OS commands on the charging station, potentially leading to device takeover and network compromise.
Recommendation
Update Autel Maxi Charger Single firmware to a version after V1.03.51 that includes the fix. Limit trust to OCPP servers and use authentication.
Original NVD description (English source)
Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station.