CVE-2026-8984

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Remote Code Execution in Autel Maxi Charger Single Firmware

Publication date: 2026-07-21

Last updated on: 2026-07-22

Assigner: CyberDanube

Description

Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-22

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-8984

EUVD

EUVD-2026-46637

Affected Vendors & Products

Vendor	Product	Version / Range
autel	maxi_charger_single	to 1.03.51 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability allows unauthenticated remote code execution on Autel Maxi Charger Single devices running firmware through V1.03.51. An attacker can send a crafted request to the /test endpoint on TCP port 9002, which causes the device to download, extract, and execute attacker-controlled files with root privileges.

Detection Guidance

Check if TCP port 9002 is open on the device using commands like 'nmap -p 9002 <device_ip>' or 'netstat -tuln | grep 9002'. If the port is open, the device may be vulnerable.

Impact Analysis

This vulnerability can allow attackers to gain full control over the affected device with root privileges. This could lead to unauthorized access, data theft, or manipulation of the charging system, potentially affecting the safety and functionality of the device.

Compliance Impact

This vulnerability allows unauthenticated remote code execution with root privileges, which could lead to unauthorized access to sensitive data stored on the device. For GDPR, this may result in a data breach requiring notification under Article 33. For HIPAA, it could compromise protected health information, violating the Security Rule. The lack of authentication and high impact on confidentiality and integrity directly conflicts with compliance requirements.

Mitigation Strategies

Isolate the device from the network to prevent remote access. Update the firmware to the latest version if an update is available. Block TCP port 9002 at the firewall level.

Hi! I’m here to help you understand CVE-2026-8984. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70