CVE-2026-8985 — Unauthenticated Command Injection
Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply …
Published: 2026-07-21 · CVSS: 10.0 · CVSS 4.0
Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7