CVE-2026-8985
The Autel Maxi Charger Single firmware (up to version V1.03.51) has a critical flaw that lets anyone on the network run arbitrary operating‑system commands through a special URL on port 9002. The flaw is easy to trigger and does not need any authentication.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Autel Maxi Charger Single firmware through V1.03.51
Real-world impact
An attacker could execute any command on the device, potentially taking full control, exfiltrating data, or using the charger as a foothold for further attacks.
Why this severity
The CVSS score of 10 reflects the combination of a high‑impact vulnerability (complete control over the system) and the fact that it is easily exploitable from the network without any user interaction or special privileges.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources