🚨Critical - Autel MaxiCharger Single Multiple Critical Vulnerabilities (CVE-2026-8984, CVE-2026-8985, CVE-2026-8986, CVE-2026-8987) Autel MaxiCharger Single EV charging stations running firmware V1.03.51 and earlier contain four separate critical vulnerabilities disclosed simultaneously. Two flaws allow unauthenticated OS command injection via the /test endpoint and general command handling, one enables unauthenticated remote code execution, and one is a heap-based buffer overflow in the set_a component. An unauthenticated attacker with network access can exploit any of these paths to fully compromise the charging station — enabling manipulation of charging sessions, pivoting into connected networks, or disrupting EV infrastructure. No credentials required across all four vulnerabilities. 👉Affected: Autel MaxiCharger Single firmware ≤ V1.03.51 No patched version currently available. Monitor vendor advisory for firmware update.
Post summary
Autel MaxiCharger Single firmware V1.03.51 and earlier is affected by four critical vulnerabilities (CVE‑2026‑8984 through 8987) that allow unauthenticated command injection, remote code execution, and a heap overflow; no patch is available yet, so users should monitor vendor advisories for an update.
