PT-2026-62416 · Autel · Maxicharger Single

D. Blagojevic + 3 · CVE-2026-8985 · Publicado 2026-07-21 · Atualizado 2026-07-21

NVD

CVSS v4.0

10

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-8985

Produtos afetados

Maxicharger Single

Referências · 2

• 🔥 https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8985 · Nota de Segurança