CVE-2026-8987 Overview
CVE-2026-8987 is a heap-based buffer overflow [CWE-122] in the Autel Maxi Charger Single firmware through version V1.03.51. The flaw resides in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input to trigger memory corruption on the heap. Successful exploitation results in denial of service and may enable arbitrary code execution on the charger. The issue was disclosed by CyberDanube Security Research as part of a broader advisory covering multiple vulnerabilities in the Autel Maxi Charger product line.
Critical Impact
An authenticated network attacker can corrupt heap memory in the charger firmware, disrupting operation and potentially executing arbitrary code on the device.
Affected Products
- Autel Maxi Charger Single firmware versions through V1.03.51
- set_ap_param command handler within the firmware
- /localcfg HTTP endpoint
Discovery Timeline
- 2026-07-21 - CVE-2026-8987 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-8987
Vulnerability Analysis
The vulnerability is a heap-based buffer overflow in the firmware's configuration handler. When the /localcfg endpoint processes the set_ap_param command, it copies attacker-supplied data into a heap-allocated buffer without enforcing a length check. Sending an oversized parameter overwrites adjacent heap metadata and objects. This corruption can crash the service or allow an attacker to redirect execution flow. The attacker must hold valid credentials to reach the endpoint, but no user interaction is required.
Root Cause
The root cause is missing bounds validation on input passed to the set_ap_param handler. The firmware allocates a fixed-size heap buffer for access point parameters and then writes attacker-controlled bytes into it without checking length. This is a classic [CWE-122] pattern where an unchecked copy operation overruns the destination allocation. Because the affected code path runs inside the charger's management service, corruption directly impacts control-plane operations.
Attack Vector
Exploitation is network-based. An authenticated attacker sends a crafted HTTP request to the /localcfg endpoint with a set_ap_param payload containing oversized values. The malformed request reaches the vulnerable handler and triggers the overflow during parameter processing. Attackers with low-privilege credentials, including any account that can reach the local configuration interface, can weaponize the flaw. Detailed technical analysis is available in the CyberDanube Security Research advisory.
Detection Methods for CVE-2026-8987
Indicators of Compromise
- HTTP POST requests to /localcfg containing set_ap_param with abnormally long parameter values.
- Unexpected restarts, crashes, or watchdog resets of the Autel Maxi Charger management service.
- Authentication events from unusual source IP addresses followed by malformed configuration requests.
Detection Strategies
- Inspect network traffic to the charger for requests to /localcfg and flag payloads exceeding expected field sizes for set_ap_param.
- Correlate authenticated session activity with subsequent service crashes or reboot events on the device.
- Baseline normal configuration traffic and alert on outliers in request size or parameter length.
Monitoring Recommendations
- Forward charger logs and syslog output to a centralized logging platform for continuous review.
- Monitor for repeated failed or malformed requests to the /localcfg endpoint.
- Track firmware version inventory to identify devices still running versions through V1.03.51.
How to Mitigate CVE-2026-8987
Immediate Actions Required
- Restrict network access to the charger's management interface to trusted administrative networks only.
- Rotate credentials for any account authorized to reach the /localcfg endpoint.
- Audit device inventories for Autel Maxi Charger Single units running firmware through V1.03.51.
Patch Information
At the time of publication, no vendor patch reference is listed in the NVD entry. Review the CyberDanube Security Research advisory for coordinated disclosure updates and consult Autel directly for a fixed firmware release beyond V1.03.51.
Workarounds
- Place the charger behind a firewall or VLAN that blocks untrusted access to the HTTP management interface.
- Disable remote configuration features where the deployment does not require them.
- Enforce strong, unique credentials on all authenticated accounts to limit the pool of attackers able to reach the vulnerable endpoint.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
