CVE-2026-8986: Autel Maxi Charger RCE Vulnerability

CVE-2026-8986 Overview

CVE-2026-8986 is an operating system command injection vulnerability affecting Autel Maxi Charger Single firmware through version V1.03.51. The charging station fails to sanitize the diagnostics URL parameter supplied in Open Charge Point Protocol (OCPP) GetDiagnostics requests. A malicious or compromised OCPP server can inject shell metacharacters into this parameter and execute arbitrary commands on the charger. The flaw is tracked under CWE-78 and was disclosed by Cyber Danube security researchers.

Critical Impact
An attacker controlling the OCPP backend gains arbitrary command execution on the electric vehicle charging station, compromising confidentiality, integrity, and availability of the device and any connected infrastructure.

Affected Products

Autel Maxi Charger Single firmware through V1.03.51
Deployments relying on unauthenticated or attacker-reachable OCPP server connections
Fleet and public charging stations exposing OCPP endpoints across untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-8986 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-8986

Vulnerability Analysis

The Autel Maxi Charger Single implements the OCPP GetDiagnostics message, which instructs the station to upload diagnostic logs to a URL supplied by the backend server. The firmware passes the supplied URL directly to an operating system shell without validating or escaping its contents. An attacker can append shell metacharacters such as ;, |, or backticks to the URL, causing the shell to interpret them as additional commands. Successful exploitation yields arbitrary command execution in the context of the diagnostics handler, which typically runs with elevated privileges on embedded chargers.

Root Cause

The root cause is missing input validation on OCPP-supplied string parameters, specifically the diagnostics upload location. The firmware invokes a shell command, likely wget, curl, or a similar utility, with the attacker-controlled URL concatenated into the command string. This pattern maps directly to CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Attack Vector

Exploitation requires that the charger accept OCPP commands from an attacker-controlled or compromised server. Adversaries can achieve this by compromising the legitimate Charging Station Management System (CSMS), performing a man-in-the-middle attack on unencrypted OCPP-J WebSocket traffic, or spoofing the backend where certificate validation is absent. Once positioned, the attacker sends a crafted GetDiagnostics request whose location field embeds shell metacharacters followed by attacker commands.

Refer to the Cyber Danube Vulnerability Research advisory for reproduction details. No verified proof-of-concept code is published in the CVE record.

Detection Methods for CVE-2026-8986

Indicators of Compromise

Outbound network connections from chargers to unexpected hosts following OCPP GetDiagnostics messages
OCPP messages whose location parameter contains shell metacharacters such as ;, |, &, $(, or backticks
Unexpected child processes spawned by the diagnostics or firmware update handler on the charging station
Modified startup scripts, cron entries, or SSH authorized_keys files on the charger filesystem

Detection Strategies

Inspect OCPP-J WebSocket traffic between the CSMS and chargers for malformed or metacharacter-laden URLs in diagnostics requests
Enable verbose logging on the OCPP backend and alert on GetDiagnostics payloads that deviate from expected URL schemas
Perform integrity monitoring on charger firmware and configuration partitions where writable

Monitoring Recommendations

Baseline outbound connectivity from each charger and alert on connections to hosts outside the diagnostics upload allowlist
Correlate CSMS-issued GetDiagnostics commands with the resulting outbound HTTP requests and process activity on the charger
Monitor the CSMS itself for account takeover, since compromise of the backend is the primary path to exploitation

How to Mitigate CVE-2026-8986

Immediate Actions Required

Inventory all Autel Maxi Charger Single units and identify firmware builds at or below V1.03.51
Restrict OCPP connectivity to a hardened, mutually authenticated CSMS over TLS with strict certificate pinning
Audit CSMS accounts and rotate credentials that can issue GetDiagnostics commands
Segment charging stations onto isolated network zones with egress filtering to prevent lateral movement

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-8986. Operators should contact Autel for firmware updates addressing the OCPP command injection and monitor the Cyber Danube advisory for coordinated fix information.

Workarounds

Deploy a protocol-aware proxy in front of the charger that validates OCPP GetDiagnostics URLs against a strict allowlist
Terminate OCPP over TLS (OCPP-S / wss://) with mutual authentication to eliminate man-in-the-middle scenarios
Block outbound egress from chargers except to sanctioned diagnostics upload endpoints
Disable remote diagnostics collection until firmware fixes are validated in the affected environment

bash

# Example egress restriction concept (network appliance pseudo-config)
# Permit charger traffic only to the sanctioned CSMS and diagnostics host
allow from CHARGER_VLAN to csms.example.com port 443 proto tcp
allow from CHARGER_VLAN to diag-upload.example.com port 443 proto tcp
deny  from CHARGER_VLAN to any