CVE-2026-8985CWE-78command-injection

CVE-2026-8985

Critical · published July 22, 2026

CVSS v3.1
9.8
EPSS
7%
Percentile
94.2
In the wild
Unconfirmed
What it is

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.07092 · 94.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-22T02:19Z
Affected products (2)
ProductVersionsFixed in
autel/maxicharger_single_charger_firmware≤ 1.03.51—
autel/maxicharger_single_charger_firmware≤ 1.03.51—
References (1)
https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/ · [email protected]
EPSS history
Timeline
  • 21 JUL 21:11Z
    Unauthenticated Command Injection
    cvelistv5