CVE-2026-8985 — Unauthenticated Command Injection

CVE-2026-8985

Unauthenticated Command Injection PUBLISHED

Description (CNA)

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.

Affected (CNA)

Vendor / product	Versions
Autel / MaxiCharger Single	affected 0 through V1.03.51

CWE

CWE-78

References

https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.