CVE-2026-8987

Awaiting Analysis Awaiting Analysis - Queue

Heap-based Buffer Overflow in Autel Maxi Charger Single Firmware

Publication date: 2026-07-21

Last updated on: 2026-07-22

Assigner: CyberDanube

Description

Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentially arbitrary code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-22

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-8987

EUVD

EUVD-2026-46643

Affected Vendors & Products

Vendor	Product	Version / Range
autel	maxi_charger_single	1.03.51

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is a heap-based buffer overflow in Autel Maxi Charger Single firmware through V1.03.51. It occurs in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacker can send oversized input to trigger this overflow, causing denial of service or potentially arbitrary code execution.

Detection Guidance

Detecting this vulnerability requires checking for the presence of Autel Maxi Charger Single firmware versions through V1.03.51. Inspect the device firmware version via the web interface or CLI. No specific commands are provided in the context.

Impact Analysis

The impact includes denial of service, which could disrupt charging operations, and potential arbitrary code execution, which might allow an attacker to take control of the device. Since it requires authentication, attackers need valid access credentials to exploit this.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches due to potential arbitrary code execution, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. The denial of service risk may also impact availability obligations under these regulations.

Mitigation Strategies

Immediately update the Autel Maxi Charger Single firmware to the latest version beyond V1.03.51. Restrict network access to the device to authenticated users only and monitor for unusual activity.

Hi! I’m here to help you understand CVE-2026-8987. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70