Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 28

Export CSV
CVE-2026-8985

Unauthenticated Command Injection

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

CVSS 4.0 · 10 Critical EPSS 7.1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Single Charger Maxicharger Single Charger Firmware
CVE-2026-8986

Command Injection via Malicious OCPP Server

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station.

CVSS 4.0 · 9.5 Critical EPSS 3.3% KEV · Not listed
Vendors
Autel
Products
Maxicharger Single Charger Maxicharger Single Charger Firmware
CVE-2026-8984

Unauthenticated RCE

Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Single Charger Maxicharger Single Charger Firmware
CVE-2026-8989

Open Recovery Mode

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Single Charger Maxicharger Single Charger Firmware
CVE-2026-8987

Authenticated Heap Overflow

Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentially arbitrary code execution.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Single Charger Maxicharger Single Charger Firmware
CVE-2026-8988

Access to Bootloader

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An attacker with physical access can modify the boot configuration or file system to obtain operating system access.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Single Charger Maxicharger Single Charger Firmware
CVE-2026-8982

Hard-coded / Backdoor Accounts

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web management interface with administrative privileges.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Single Charger Maxicharger Single Charger Firmware
CVE-2026-8983

Backdoor Authentication Token

Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to invoke privileged functionality without valid authentication.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Single Charger Maxicharger Single Charger Firmware
CVE-2026-13305

Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability

Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of software updates. The issue results from the lack of proper validation of a user-supplied software update image. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29062.

CVSS 3.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Ac Elite Home
CVE-2026-13306

Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability

Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the exposed USB interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29046.

CVSS 3.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Ac Elite Home
CVE-2026-13309

Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability

Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of card responses via the NFC interface. A crafted card response can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29044.

CVSS 3.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Ac Elite Home
CVE-2026-13307

Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability

Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of custom USB packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29048.

CVSS 3.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Ac Elite Home
CVE-2026-13308

Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability

Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of WebSocket messages related to the OCPP service. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-29113.

CVSS 3.0 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Ac Elite Home
CVE-2025-5824

Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability

Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of bluetooth pairing requests. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26353.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Ac Elite Business C50 Maxicharger Ac Elite Business C50 Firmware Maxicharger Ac Pro and 15 more
CVE-2025-5823

Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability

Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Ac Elite Business C50 Maxicharger Ac Elite Business C50 Firmware Maxicharger Ac Pro and 15 more
CVE-2025-5822

Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability

Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability. The specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Ac Elite Business C50 Maxicharger Ac Elite Business C50 Firmware Maxicharger Ac Pro and 15 more
CVE-2025-5825

Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability

Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a firmware image before using it to perform an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-26354.

CVSS 3.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Ac Elite Business C50 Maxicharger Ac Elite Business C50 Firmware Maxicharger Ac Pro and 15 more
CVE-2025-5826

Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability

Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368.

CVSS 3.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Ac Elite Business C50 Maxicharger Ac Elite Business C50 Firmware Maxicharger Ac Pro and 15 more
CVE-2025-5827

Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability

Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ble_process_esp32_msg function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26369.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Ac Elite Business C50 Maxicharger Ac Elite Business C50 Firmware Maxicharger Ac Pro and 15 more
CVE-2025-5828

Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability

Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of USB frame packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26328.

CVSS 3.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Autel
Products
Maxicharger Ac Elite Business C50 Maxicharger Ac Elite Business C50 Firmware Maxicharger Ac Pro and 15 more