← Database

CVE-2026-8985

CRITICAL CVSS: 9.8 Published: 2026-07-21 Modified: 2026-08-13

Description

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

Affected Platforms

Autel Maxicharger Single Charger FirmwareAutel Maxicharger Single Charger

Weakness Type

CWE-78

References