CVE-2026-8984
Autel Maxi Charger Single firmware up to V1.03.51 contains a critical flaw that lets anyone on the network send a crafted request to TCP port 9002 and cause the device to download and run arbitrary code with root privileges. This could allow a remote attacker to take full control of the charger.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Autel Maxi Charger Single devices running firmware version V1.03.51 or earlier.
Real-world impact
An attacker could remotely execute code on the charger with root privileges, potentially taking control of the device, exfiltrating data, or using it as a foothold for further attacks.
Why this severity
The CVSS score of 10 reflects that the vulnerability is exploitable over the network without authentication, allows full control of the device, and has no mitigations or workarounds, making it a critical risk.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources