CVE-2026-8985: Autel Maxi Charger RCE Vulnerability

CVE-2026-8985 Overview

CVE-2026-8985 is an operating system command injection vulnerability in the Autel Maxi Charger Single firmware through version V1.03.51. The /test endpoint exposed on TCP port 9002 accepts a url parameter that is passed to an underlying OS command without sanitization. An unauthenticated remote attacker can inject shell metacharacters to execute arbitrary commands on the charger with the privileges of the vulnerable service. The flaw is tracked under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Unauthenticated network attackers can gain arbitrary command execution on Autel Maxi Charger Single devices, compromising charger control, connected networks, and vehicle charging sessions.

Affected Products

Autel Maxi Charger Single firmware versions up to and including V1.03.51
Devices exposing the management service on TCP port 9002
Deployments where the charger is reachable from untrusted network segments

Discovery Timeline

2026-07-21 - CVE-2026-8985 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database
Details published by CyberDanube Security Research

Technical Details for CVE-2026-8985

Vulnerability Analysis

The Autel Maxi Charger Single firmware exposes an HTTP-style service on TCP port 9002. The /test endpoint accepts a url parameter that the firmware forwards to a system shell invocation, likely for connectivity or reachability testing. Because the parameter value is concatenated into the command string without validation or safe argument passing, an attacker can append shell metacharacters such as ;, |, &, or backticks to break out of the intended command and execute arbitrary binaries.

Exploitation requires no authentication and no user interaction. A single crafted HTTP request to the charger yields command execution in the context of the service handling the endpoint. On embedded chargers, this context often has extensive privileges over the device, including network configuration, firmware update routines, and charging control logic. Successful exploitation enables lateral movement into operator networks, manipulation of charging behavior, persistence via modified firmware components, and extraction of credentials or telemetry stored on the device.

Root Cause

The root cause is the direct passing of an attacker-controlled url parameter into an OS command invocation without input validation, allow-listing, or use of parameterized process execution APIs. This is a textbook instance of CWE-78.

Attack Vector

The attack vector is network-based against TCP port 9002. An attacker sends an HTTP request to /test with a url parameter containing an injected shell command. Because no authentication is enforced on the endpoint, exposure to any routable network — including operator LANs, guest Wi-Fi bridged segments, or the internet if port 9002 is forwarded — is sufficient for exploitation. Refer to the CyberDanube advisory for reproduction details.

Detection Methods for CVE-2026-8985

Indicators of Compromise

Inbound TCP connections to port 9002 from unexpected external or internal sources
HTTP requests targeting the /test path containing shell metacharacters (;, |, &, $(, backticks) in the url parameter
Unexpected child processes spawned by the charger management service, such as sh, wget, curl, busybox, or nc
Outbound connections from the charger to unknown hosts shortly after /test requests

Detection Strategies

Deploy network intrusion detection signatures that flag HTTP requests to /test on port 9002 containing shell metacharacter patterns in the url parameter
Baseline expected traffic to and from Autel chargers and alert on deviations, particularly new outbound sessions initiated by the charger
Where firmware permits, enable local process auditing on the device and forward logs to a central collector for correlation

Monitoring Recommendations

Log all connections to TCP port 9002 at the perimeter and at internal segmentation points
Correlate charger access logs with authentication events and firmware update activity
Monitor DNS queries originating from charger IP addresses for signs of command-and-control staging

How to Mitigate CVE-2026-8985

Immediate Actions Required

Restrict network access to TCP port 9002 on all Autel Maxi Charger Single devices using firewall rules and network segmentation
Remove any internet exposure of the charger management interface, including port forwards and NAT rules
Inventory all Autel Maxi Charger Single devices and record installed firmware versions for tracking
Contact Autel support to obtain a firmware version that remediates the /test endpoint command injection

Patch Information

No fixed firmware version has been published in the NVD entry at the time of writing. Autel Maxi Charger Single firmware versions through V1.03.51 are affected. Consult the CyberDanube advisory and the vendor for update availability, and apply firmware updates once released.

Workarounds

Place chargers on an isolated VLAN that only permits traffic to and from required backend management systems
Block inbound traffic to TCP port 9002 from all networks except a dedicated management host
Disable remote management features on the charger if the deployment does not require them
Deploy an inline proxy or firewall rule that drops HTTP requests to /test containing shell metacharacters until a patched firmware is installed

bash

# Example iptables rule restricting access to the charger management port
iptables -A INPUT -p tcp --dport 9002 -s 10.10.20.5 -j ACCEPT
iptables -A INPUT -p tcp --dport 9002 -j DROP