CVE-2026-8984 is a critical (CVSS 9.8) remote code execution flaw in Autel Maxi Charger Single firmware through V1.03.51. The service on TCP port 9002 lets an unauthenticated request make the device fetch and run files as root. Block the port and ask Autel for a fix.
What's affected
The record lists Autel Maxi Charger Single firmware through V1.03.51. The CyberDanube research page covers a group of eleven issues in this product, and this CVE is one of them.
I could not confirm a fixed firmware version from the pages I could read. Ask Autel for the current firmware and its release notes, and treat all units on V1.03.51 or older as affected.
How to check if you're exposed
Open the charger's web interface or its management app and read the firmware version. If it shows V1.03.51 or lower, it is in range.
Then check where the charger sits on the network. Ask whether its management interface and the service on TCP port 9002 can be reached from the internet, from guest or tenant networks, or from other buildings. A port scan from a trusted internal host, run only against devices you own, will confirm it:
nmap -p 9002 192.0.2.10
Replace the example address with your own charger.
What to do now
- List every Autel Maxi Charger Single unit and its firmware version.
- Contact Autel for a firmware update and apply it as soon as it is available.
- Remove the chargers from the internet and block inbound access to TCP port 9002 at the firewall.
- Put chargers on their own network segment, away from business systems and guest Wi-Fi.
- Restrict the management interface to a small set of administrator addresses.
- Make sure the connection to your charging network operator uses TLS, and confirm the operator is one you trust.
Why it matters
The record lists CWE-94 (improper control of generation of code). The record says a crafted request to a test endpoint on port 9002 can make the device download, extract and execute files with root privileges, and no login is needed.
A charger is a computer attached to mains power and often to a payment or billing system. Full control by a stranger could mean disruption of charging, access to the local network, or use of the device for other attacks. Treat it like any exposed server.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
What should I block first?
Inbound access to TCP port 9002, from everywhere except a trusted management host if you need one.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
