CVE-2026-8986 is a critical (CVSS 9.8) OS command injection flaw in Autel Maxi Charger Single firmware through V1.03.51. A malicious or compromised OCPP server can send a crafted diagnostics URL and run commands on the charger. Secure the connection to your OCPP server and ask Autel for an update.
What's affected
The record lists Autel Maxi Charger Single firmware through V1.03.51. The CyberDanube research page covers a group of eleven issues in this product, and this CVE is one of them.
I could not confirm a fixed firmware version from the pages I could read. Ask Autel for the current firmware and its release notes, and treat all units on V1.03.51 or older as affected.
How to check if you're exposed
Open the charger's web interface or its management app and read the firmware version. If it shows V1.03.51 or lower, it is in range.
Then check where the charger sits on the network. Ask whether its management interface and the service on TCP port 9002 can be reached from the internet, from guest or tenant networks, or from other buildings. A port scan from a trusted internal host, run only against devices you own, will confirm it:
nmap -p 9002 192.0.2.10
Replace the example address with your own charger.
What to do now
- List every Autel Maxi Charger Single unit and its firmware version.
- Contact Autel for a firmware update and apply it as soon as it is available.
- Remove the chargers from the internet and block inbound access to TCP port 9002 at the firewall.
- Put chargers on their own network segment, away from business systems and guest Wi-Fi.
- Restrict the management interface to a small set of administrator addresses.
- Make sure the connection to your charging network operator uses TLS, and confirm the operator is one you trust.
Why it matters
The record lists CWE-78 (OS command injection). OCPP is the protocol chargers use to talk to a central management system. In this case a GetDiagnostics request carries a URL, and the record says the URL can be crafted so that it runs commands on the charging station.
The attacker here is the server side. That makes the trust in your charging network operator and in the link to it the main control. Use TLS for the connection, restrict which servers the charger will connect to, and monitor for changes in the configured server address.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
Who is the attacker in this flaw?
A malicious or compromised OCPP server, according to the record. Protect the OCPP link and the server account.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
