Skip to content
OpenAdvisories

Product · Autel

MaxiCharger Single

8 known vulnerabilities.

MaxiCharger Single at a glance

Last 12 months
8
Critical · all time
6
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 8 vulnerabilities, 6 critical August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202686
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • High 8.6
    CVE-2026-8989

    Open Recovery Mode

    Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware …

    Autel MaxiCharger Single
  • High 8.6
    CVE-2026-8988

    Access to Bootloader

    Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An attacker with physical access can modify the boot configuration or file system to ob…

    Autel MaxiCharger Single
  • Critical 9.4
    CVE-2026-8987

    Authenticated Heap Overflow

    Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentially arbit…

    Autel MaxiCharger Single
  • Critical 9.5
    CVE-2026-8986

    Command Injection via Malicious OCPP Server

    Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on …

    Autel MaxiCharger Single
  • Critical 10.0
    CVE-2026-8985

    Unauthenticated Command Injection

    Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

    Autel MaxiCharger Single
  • Critical 10.0
    CVE-2026-8984

    Unauthenticated RCE

    Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled fil…

    Autel MaxiCharger Single
  • Critical 10.0
    CVE-2026-8983

    Backdoor Authentication Token

    Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to invoke privileged functionality without vali…

    Autel MaxiCharger Single
  • Critical 10.0
    CVE-2026-8982

    Hard-coded / Backdoor Accounts

    Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and require…

    Autel MaxiCharger Single