CVE-2026-8982
Autel Maxi Charger Single firmware versions up to V1.03.51 contain two undocumented privileged accounts that can be accessed using a vendor‑defined password derivation algorithm. An attacker who knows the algorithm can log in to the web management interface with full administrative rights. This flaw allows complete control over the device.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Autel Maxi Charger Single firmware versions up to V1.03.51.
Real-world impact
An attacker could gain unrestricted administrative access to the device, enabling configuration changes, firmware updates, or data exfiltration.
Why this severity
The CVSS score of 10 reflects that the vulnerability provides full administrative privileges (high confidentiality, integrity, and availability impact) with no authentication or user interaction required, making it a critical risk.
What to do about it
- ›Upgrade the device firmware to a version newer than V1.03.51 when a vendor patch becomes available.
- ›If an upgrade is not possible, consider disabling or removing the undocumented privileged accounts if the device firmware allows such configuration.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources