PT-2026-62416 · Autel · Maxicharger Single

D. Blagojevic + 3 · CVE-2026-8985 · Published 2026-07-21 · Updated 2026-07-21

NVD

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-8985

Affected Products

Maxicharger Single

References · 2

• 🔥 https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8985 · Security Note