CVE-2026-8985

Awaiting Analysis Awaiting Analysis - Queue

OS Command Injection in Autel Maxi Charger Single Firmware

Publication date: 2026-07-21

Last updated on: 2026-07-22

Assigner: CyberDanube

Description

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-22

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-8985

EUVD

EUVD-2026-46639

Affected Vendors & Products

Vendor	Product	Version / Range
autel	maxi_charger_single	to 1.03.51 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in Autel Maxi Charger Single firmware through V1.03.51. It exists in the /test endpoint exposed on TCP port 9002. An attacker can send crafted input via the url parameter to execute arbitrary operating system commands without authentication.

Detection Guidance

Check if TCP port 9002 is open on the device. Use commands like 'nc -zv <target_ip> 9002' or 'nmap -p 9002 <target_ip>' to verify port exposure. If the port is open, the device may be vulnerable.

Impact Analysis

An unauthenticated attacker could exploit this to run malicious commands on the device, potentially gaining full control over the system. This could lead to data theft, device manipulation, or disruption of charging operations.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations using this device may face compliance violations and legal penalties.

Mitigation Strategies

Immediately disconnect the device from the network to prevent exploitation. Contact Autel for a firmware update. If no update is available, consider replacing the device as it is end-of-life for security patches.

Hi! I’m here to help you understand CVE-2026-8985. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70