Signal is active with 1 mentions in latest observed window
Immediate actions
Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.
Autel の EV 充電器で未認証のリモートコード実行。TCP 9002 の /test にリクエストを送ると、機器が攻撃者のファイルをダウンロードして root で実行します。この種の機器は IT の資産台帳に載っていないことが多いので、まず設備側に型番を聞くところからにな…
https://cve.autoarticles.net/cve/CVE-2026-8984
Post summary
The article announces an unauthenticated remote code execution vulnerability (CVE‑2026‑8984) in an Autel EV charger, detailing how a request to TCP 9002 /test leads to malicious file download and execution, but provides no PoC, exploit code, or evidence of active exploitation.
🚨Critical - Autel MaxiCharger Single Multiple Critical Vulnerabilities (CVE-2026-8984, CVE-2026-8985, CVE-2026-8986, CVE-2026-8987)
Autel MaxiCharger Single EV charging stations running firmware V1.03.51 and earlier contain four separate critical vulnerabilities disclosed simultaneously. Two flaws allow unauthenticated OS command injection via the /test endpoint and general command handling, one enables unauthenticated remote code execution, and one is a heap-based buffer overflow in the set_a component. An unauthenticated attacker with network access can exploit any of these paths to fully compromise the charging station — enabling manipulation of charging sessions, pivoting into connected networks, or disrupting EV infrastructure. No credentials required across all four vulnerabilities.
👉Affected: Autel MaxiCharger Single firmware ≤ V1.03.51
No patched version currently available. Monitor vendor advisory for firmware update.
Post summary
Four critical vulnerabilities (CVE‑2026‑8984 to CVE‑2026‑8987) have been disclosed in Autel MaxiCharger Single firmware ≤ V1.03.51, allowing unauthenticated command injection, RCE, and buffer overflow, with no patch currently available and users urged to watch for vendor updates.
