critical9.8
CVE-2026-8984
Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002.
Impact
Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Autel | Maxicharger Single Charger Firmware | through 1.03.51 |