CVE-2026-8985Disclosure(autel / maxicharger_single_charger)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch autel maxicharger_single_charger systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

autel CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

maxicharger_single_charger
maxicharger_single_charger_firmware

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 4 classified signals
Peaked 2d ago at 2 mentions (2026-07-21); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

autel

Products

maxicharger_single_chargermaxicharger_single_charger_firmware

1 version affected across 2 products

Deep dive

Activity timeline4 mentions / 3d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-21	2	Disclosure2
2026-07-22	1	Disclosure1
2026-07-31	1	Disclosure1

Full discourse4 posts

Kaitan ID Security@KaitanSecurity82d
Disclosure
⚡ Autel Maxi Charger — Dual Critical RCE in EV Charging Infrastructure (CVSS 10.0) Two separate CVEs hit the same hardware this week. CVE-2026-8985 documents an OS command injection flaw in the /test endpoint exposed on TCP port 9002 of Autel Maxi Charger Single…
Post summary
The tweet announces two critical CVEs for Autel Maxi Charger, detailing an OS command injection flaw with a CVSS score of 10.0, but provides no information on PoC, exploitation tools, or patches.
1000057
87 followersView on X
Upwind Security MDR@UpwindMDR91d
Disclosure
🚨Critical - Autel MaxiCharger Single Multiple Critical Vulnerabilities (CVE-2026-8984, CVE-2026-8985, CVE-2026-8986, CVE-2026-8987) Autel MaxiCharger Single EV charging stations running firmware V1.03.51 and earlier contain four separate critical vulnerabilities disclosed simultaneously. Two flaws allow unauthenticated OS command injection via the /test endpoint and general command handling, one enables unauthenticated remote code execution, and one is a heap-based buffer overflow in the set_a component. An unauthenticated attacker with network access can exploit any of these paths to fully compromise the charging station — enabling manipulation of charging sessions, pivoting into connected networks, or disrupting EV infrastructure. No credentials required across all four vulnerabilities. 👉Affected: Autel MaxiCharger Single firmware ≤ V1.03.51 No patched version currently available. Monitor vendor advisory for firmware update.
Post summary
Autel MaxiCharger Single firmware V1.03.51 and earlier are affected by four critical vulnerabilities—two command injection flaws, one remote code execution flaw, and a heap-based buffer overflow—with no patch available yet; monitoring the vendor advisory is advised.
0000099
254 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-8985 Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker ca… https://www.cve.org/CVERecord?id=CVE-2026-8985 ----- Traducción: CVE-2026-8985 Aut… http://infoflow.cloud`
Post summary
The statement announces CVE‑2026‑8985 as an OS command injection vulnerability in the Autel Maxi Charger firmware, providing technical details without any PoC, exploit, or patch information.
0000056
94 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-8985 Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker ca… https://www.cve.org/CVERecord?id=CVE-2026-8985
Post summary
The post announces a new CVE (2026-8985) exposing OS command injection via the /test endpoint on port 9002 of Autel Maxi Charger firmware V1.03.51, providing technical details but no PoC, exploit code, or patch information.
000001.1K
57.8K followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	autel	maxicharger_single_charger	-	-	-
OS	autel	maxicharger_single_charger_firmware	-	-	-
OS	autel	maxicharger_single_charger_firmware	-	-	-

Explore more

Back to dashboard autel CVEs maxicharger_single_charger vulnerabilities

What researchers are saying

CVE-2026-8985

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The tweet announces two critical CVEs for Autel Maxi Charger, detailing an OS command injection flaw with a CVSS score of 10.0, but provides no information on PoC, exploitation tools, or patches.

Upwind Security MDR[verified]@UpwindMDRDisclosure

Autel MaxiCharger Single firmware V1.03.51 and earlier are affected by four critical vulnerabilities—two command injection flaws, one remote code execution flaw, and a heap-based buffer overflow—with no patch available yet; monitoring the vendor advisory is advised.

Infoflowcloud@infoflowcloudDisclosure

The statement announces CVE‑2026‑8985 as an OS command injection vulnerability in the Autel Maxi Charger firmware, providing technical details without any PoC, exploit, or patch information.

CVE@CVEnewDisclosure

The post announces a new CVE (2026-8985) exposing OS command injection via the /test endpoint on port 9002 of Autel Maxi Charger firmware V1.03.51, providing technical details but no PoC, exploit code, or patch information.