CVE-2026-8985 is a critical (CVSS 9.8) OS command injection flaw in Autel Maxi Charger Single firmware through V1.03.51. An unauthenticated attacker can run operating system commands through the url parameter of the test endpoint on TCP port 9002. Block that port and ask Autel for a fix.
What's affected
The record lists Autel Maxi Charger Single firmware through V1.03.51. The CyberDanube research page covers a group of eleven issues in this product, and this CVE is one of them.
I could not confirm a fixed firmware version from the pages I could read. Ask Autel for the current firmware and its release notes, and treat all units on V1.03.51 or older as affected.
How to check if you're exposed
Open the charger's web interface or its management app and read the firmware version. If it shows V1.03.51 or lower, it is in range.
Then check where the charger sits on the network. Ask whether its management interface and the service on TCP port 9002 can be reached from the internet, from guest or tenant networks, or from other buildings. A port scan from a trusted internal host, run only against devices you own, will confirm it:
nmap -p 9002 192.0.2.10
Replace the example address with your own charger.
What to do now
- List every Autel Maxi Charger Single unit and its firmware version.
- Contact Autel for a firmware update and apply it as soon as it is available.
- Remove the chargers from the internet and block inbound access to TCP port 9002 at the firewall.
- Put chargers on their own network segment, away from business systems and guest Wi-Fi.
- Restrict the management interface to a small set of administrator addresses.
- Make sure the connection to your charging network operator uses TLS, and confirm the operator is one you trust.
Why it matters
The record lists CWE-78 (OS command injection). Input from the url parameter reaches a system command without being neutralized, so crafted text becomes part of the command.
The record shows no login needed and network reach. It sits on the same service as CVE-2026-8984, so closing access to port 9002 reduces both risks. The fix in code is to avoid passing user input to a shell and to validate it against a strict format.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
Is this the same as CVE-2026-8984?
No. They are separate flaws on the same service. Both are covered by blocking port 9002 and by a firmware update.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
