CVE-2026-8986

Awaiting Analysis Awaiting Analysis - Queue

OS Command Injection in Autel Maxi Charger Single Firmware

Publication date: 2026-07-21

Last updated on: 2026-07-22

Assigner: CyberDanube

Description

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-22

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-8986

EUVD

EUVD-2026-46640

Affected Vendors & Products

Vendor	Product	Version / Range
autel	maxi_charger_single	to 1.03.51 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in Autel Maxi Charger Single firmware through V1.03.51. It occurs when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can send a specially crafted diagnostics URL that allows arbitrary command execution on the charging station.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized command execution attempts via OCPP GetDiagnostics requests. Monitor network traffic for suspicious OCPP messages containing crafted URLs. Inspect system logs for unexpected command executions or unusual processes spawned by the Maxi Charger firmware.

Impact Analysis

An attacker could exploit this to execute arbitrary commands on the charging station, potentially gaining control over the device. This could lead to unauthorized access, data theft, or disruption of charging operations.

Compliance Impact

This vulnerability allows arbitrary command execution on the charging station via crafted OCPP requests, which could lead to unauthorized access or data exfiltration. Such breaches may violate GDPR's data protection requirements or HIPAA's security rules if sensitive data is exposed.

Mitigation Strategies

Immediately update the Autel Maxi Charger Single firmware to the latest version if available. Isolate the charging station from untrusted networks. Disable OCPP GetDiagnostics functionality if not required. Implement network monitoring to detect and block malicious OCPP requests.

Hi! I’m here to help you understand CVE-2026-8986. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70