CVE-2026-8987
A heap-based buffer overflow exists in the Autel Maxi Charger firmware V1.03.51. The flaw is triggered by the set_ap_param command on the /localcfg endpoint when an authenticated user supplies oversized input. It can cause a denial of service and may allow arbitrary code execution.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Owners of Autel Maxi Charger devices running firmware version 1.03.51.
Real-world impact
An attacker who can authenticate to the charger can crash the device or run malicious code, potentially compromising the charger and any devices connected to it.
Why this severity
The CVSS score of 9.4 reflects the vulnerability’s high impact on confidentiality, integrity, and availability, combined with its low attack complexity and the fact that it requires authentication but offers a high likelihood of successful exploitation.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources