CVE-2026-8984: Autel Maxi Charger Single RCE Vulnerability

CVE-2026-8984 Overview

CVE-2026-8984 is an unauthenticated remote code execution vulnerability in the Autel Maxi Charger Single firmware through version V1.03.51. The device exposes a service on TCP port 9002 that accepts crafted requests to a /test endpoint. An attacker can force the charger to download, extract, and execute attacker-controlled files with root privileges. The flaw is classified under CWE-94: Improper Control of Generation of Code. No authentication is required, and the attack is reachable over the network.

Critical Impact
Unauthenticated attackers can achieve remote root code execution on Autel Maxi Charger Single devices through a single crafted request to the /test endpoint on TCP port 9002.

Affected Products

Autel Maxi Charger Single firmware, all versions up to and including V1.03.51
Devices exposing the management service on TCP port 9002
Electric vehicle charging deployments using the affected firmware branch

Discovery Timeline

2026-07-21 - CVE-2026-8984 published to NVD
2026-07-22 - Last updated in NVD database
Vulnerability research published by CyberDanube Security Research

Technical Details for CVE-2026-8984

Vulnerability Analysis

The Autel Maxi Charger Single firmware runs a network service bound to TCP port 9002. This service exposes a /test endpoint that processes requests without authenticating the caller. The endpoint accepts parameters that direct the device to retrieve a remote archive, extract it on the local filesystem, and execute its contents. Because the extraction and execution steps run in the context of root, an attacker gains full control of the device.

The vulnerability aligns with [CWE-94], where untrusted input controls code that the device executes. In this case, the untrusted input is the URL and payload the charger fetches and runs. There is no integrity check, code signing verification, or origin validation on the downloaded artifact.

Root Cause

The root cause is the combination of a diagnostic-style /test handler that is reachable without authentication and a workflow that treats network-supplied resources as trusted executables. The handler chains three unsafe operations: unauthenticated intake, unrestricted download, and privileged execution. Any of these mitigations, applied individually, would break the exploit chain.

Attack Vector

An attacker with network reachability to TCP port 9002 sends a single crafted HTTP request to the /test endpoint. The request references an attacker-controlled URL that hosts a malicious archive. The charger fetches the archive, extracts it, and executes the embedded binary or script as root. No user interaction, credentials, or prior foothold are required. Refer to the CyberDanube advisory for the request structure and technical walkthrough.

Detection Methods for CVE-2026-8984

Indicators of Compromise

Inbound TCP connections to port 9002 on Autel Maxi Charger Single devices from unexpected sources
HTTP requests containing the /test path directed at charger management interfaces
Outbound HTTP or HTTPS requests from chargers to unknown hosts fetching archive files such as .tar, .tar.gz, or .zip
New processes running as root on the charger that were not part of the vendor firmware image

Detection Strategies

Inspect network flows for any traffic to TCP port 9002 on charger IP ranges and alert on external sources
Deploy signatures on network sensors that match HTTP requests to /test on port 9002
Baseline the outbound connectivity of charger devices and alert on deviations, especially file downloads
Correlate charger network anomalies with firmware version data to prioritize devices at or below V1.03.51

Monitoring Recommendations

Log all administrative and diagnostic traffic to charging infrastructure at the network perimeter
Forward charger management network telemetry to a centralized platform for retention and analysis
Monitor for repeated or scripted requests to /test that indicate scanning or mass exploitation attempts
Track firmware version inventory across the fleet to identify unpatched units

How to Mitigate CVE-2026-8984

Immediate Actions Required

Remove Autel Maxi Charger Single devices from any network segment that permits untrusted inbound access to TCP port 9002
Place chargers behind a firewall that restricts management ports to a defined administrative subnet
Audit exposed devices using external scans to identify chargers reachable from the internet on port 9002
Contact Autel support to obtain firmware guidance for versions above V1.03.51

Patch Information

No vendor patch reference is listed in the NVD entry at the time of publication. Operators should consult Autel directly and monitor the CyberDanube advisory for updates on fixed firmware releases.

Workarounds

Block TCP port 9002 at the network boundary and permit access only from authorized management hosts
Segment charger devices onto a dedicated VLAN with strict egress filtering to prevent outbound archive downloads
Disable or firewall the /test endpoint at an upstream proxy where feasible
Where remote management is not required, isolate chargers from routed networks entirely

bash

# Example iptables rules restricting access to TCP 9002
iptables -A INPUT -p tcp --dport 9002 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9002 -j DROP
# Restrict egress to known update endpoints only
iptables -A OUTPUT -o eth0 -d <vendor-update-host> -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -j DROP