CVE-2026-8985: Autel Maxicharger Single Charger Firmware

Critical severity, CVSS 9.8. EPSS: 7.1% chance of exploitation in the next 30 days.

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

Affected products

• Autel Maxicharger Single Charger Firmware: up to and including 1.03.51

Published 2026-07-21. Last modified 2026-08-13.