CVE-2026-8983
A hard‑coded authentication token in the Autel Maxi Charger firmware allows an attacker to bypass all security checks and use privileged functions without logging in. The flaw exists in firmware versions up to V1.03.51. Because the token is built into the code, normal authentication mechanisms are ineffective.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Autel Maxi Charger Single firmware versions up to V1.03.51
Real-world impact
An attacker can perform any privileged operation on the charger, such as changing settings, accessing data, or controlling charging behavior, without authentication.
Why this severity
The CVSS score of 10 reflects that the vulnerability is exploitable remotely with no authentication, provides full control over the device, and has no mitigations in place.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources