CVE-2026-8986
A recent flaw in Autel’s Maxi Charger Single firmware (up to version V1.03.51) allows attackers to run arbitrary commands on the charging station. The weakness is triggered by a specially crafted OCPP GetDiagnostics request that supplies a malicious diagnostics URL. The flaw can be exploited remotely without user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Autel Maxi Charger Single firmware versions up to V1.03.51.
Real-world impact
An attacker who can send a crafted OCPP GetDiagnostics request to the charging station can execute any command on the device’s operating system, potentially taking full control of the charger, stealing data, or disrupting charging services.
Why this severity
The CVSS score of 9.5 reflects the combination of a network‑based attack vector, low complexity, no authentication, and the ability to compromise the entire system. The vulnerability can lead to complete system compromise, which is why it is rated critical.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources