🚨Critical - Autel MaxiCharger Single Multiple Critical Vulnerabilities (CVE-2026-8984, CVE-2026-8985, CVE-2026-8986, CVE-2026-8987) Autel MaxiCharger Single EV charging stations running firmware V1.03.51 and earlier contain four separate critical vulnerabilities disclosed simultaneously. Two flaws allow unauthenticated OS command injection via the /test endpoint and general command handling, one enables unauthenticated remote code execution, and one is a heap-based buffer overflow in the set_a component. An unauthenticated attacker with network access can exploit any of these paths to fully compromise the charging station — enabling manipulation of charging sessions, pivoting into connected networks, or disrupting EV infrastructure. No credentials required across all four vulnerabilities. 👉Affected: Autel MaxiCharger Single firmware ≤ V1.03.51 No patched version currently available. Monitor vendor advisory for firmware update.
Post summary
Four critical vulnerabilities (CVE‑2026‑8984 to CVE‑2026‑8987) have been disclosed in Autel MaxiCharger Single firmware V1.03.51 and earlier, enabling unauthenticated command injection, remote code execution, and a heap‑based buffer overflow. No patch is yet available; users are urged to monitor vendor advisories for an update.
