CVE-2026-8983CWE-798hardcoded-credentials

CVE-2026-8983

Critical · published July 22, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
52.2
In the wild
Unconfirmed
What it is

Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to invoke privileged functionality without valid authentication.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00687 · 52.2th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-07-22T01:16Z
Affected products (2)
ProductVersionsFixed in
autel/maxicharger_single_charger_firmware≤ 1.03.51—
autel/maxicharger_single_charger_firmware≤ 1.03.51—
References (1)
https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/ · [email protected]
EPSS history
Timeline
  • 21 JUL 21:03Z
    Backdoor Authentication Token
    cvelistv5