Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

18 records

Vendor: Autel Component: Maxicharger Single Charger Firmware Clear all filters
TI-2026-07906 CVE-2026-8989 · GHSA-wpf3-8j9v-2qg2

Open Recovery Mode

Priority HIGH 72

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins.

CVSS 4.0HIGH 8.6 Physical No auth No interaction EPSS 0.00241 Published 2026-07-21 No fix listed CWE-1191
TI-2026-07905 CVE-2026-8988 · GHSA-qpg5-v459-hjvj

Access to Bootloader

Priority HIGH 72

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader.

CVSS 4.0HIGH 8.6 Physical No auth No interaction EPSS 0.00241 Published 2026-07-21 No fix listed CWE-1191
TI-2026-07904 CVE-2026-8987 · GHSA-qh3x-7q6p-6x7f

Authenticated heap overflow in Autel MaxiCharger Single

Priority HIGH 76

Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00637 Published 2026-07-21 No fix listed CWE-122
TI-2026-07903 CVE-2026-8986 · GHSA-pfm9-xrwg-mf3r

Command Injection via Malicious OCPP Server

Priority HIGH 76

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.03285 Published 2026-07-21 No fix listed CWE-78
TI-2026-07902 CVE-2026-8985 · GHSA-g3wx-h3f8-c23p

Unauthenticated command injection in Autel MaxiCharger Single

Priority HIGH 82

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.07092 Published 2026-07-21 No fix listed CWE-78
TI-2026-07901 CVE-2026-8984 · GHSA-9qpp-vgrg-5mhj

Unauthenticated RCE in Autel MaxiCharger Single

Priority HIGH 82

Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00905 Published 2026-07-21 No fix listed CWE-94
TI-2026-07900 CVE-2026-8983 · GHSA-hmfc-f829-2xf3

Backdoor Authentication Token

Priority HIGH 82

Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00687 Published 2026-07-21 No fix listed CWE-798
TI-2026-07899 CVE-2026-8982 · GHSA-7rv7-46cm-g66m

Hard-coded / Backdoor Accounts

Priority HIGH 82

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00479 Published 2026-07-21 No fix listed CWE-798