External risk intelligence

Autel Maxi Charger Remote Code Execution via Unauthenticated TCP Service.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-8984

The device is a network-connected charging station that exposes an unauthenticated service on TCP port 9002. As an internet-connected appliance designed for remote management and operation, such devices are commonly deployed with direct or near-direct exposure to public networks to facilitate remote monitoring and connectivity.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves a critical vulnerability in Autel Maxi Charger Single firmware that could allow unauthenticated remote code execution through a service on TCP port 9002, enabling an attacker to gain root privileges by manipulating a request to the `/test` endpoint.

Allows remote code execution.
Critical flaw for network-connected chargers.
Confirm exposure and relevant device types.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable service on TCP port 9002 from the internet without needing any credentials. By sending a specially crafted request to the `/test` endpoint, an attacker can cause the device to download and execute arbitrary code with the highest level of system privileges.

Unauthenticated network access required.
Crafted request to `/test` endpoint.
Root-level code execution possible.

Live Threat

Current exploitation, exposure, and threat context

Autel Maxi Charger Single devices, when accessible over a network, could be at risk of unauthorized code execution with root privileges. This could occur through a specially crafted request to the /test endpoint on TCP port 9002, enabling an attacker to download and execute arbitrary files.

Device firmware and root access.
Via unauthenticated network request.
Attacker gains full device control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Autel Maxi Charger Single firmware presents a critical vulnerability exploitable via TCP port 9002, allowing unauthenticated remote code execution. This impacts device owners, IT infrastructure, and security teams responsible for network-attached operational technology. The immediate first step is to inventory all Autel Maxi Charger Single devices, confirm network exposure and business criticality, identify the accountable owner, and then develop a targeted remediation plan.

Device owners and infrastructure teams must act.
Verify network exposure and device criticality.
Coordinate vendor support for remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Autel Maxi Charger Single?

The Autel Maxi Charger Single is an electric vehicle charging station. These devices are network-connected to support remote management, monitoring, and operational features for vehicle charging. The software running these units, specifically the device firmware, manages these communications. This CVE affects firmware versions up to V1.03.51, which control how the charger processes incoming network requests.

What does this vulnerability mean?

This is a Code Injection vulnerability, categorized as CWE-94. It means the software does not properly filter or validate inputs, allowing an unauthorized user to inject and execute their own commands. In this specific case, the flaw allows remote attackers to force the charger to download and run malicious files with root privileges, effectively granting them full control over the device's operating system.

How does an attacker trigger this bug?

An attacker exploits this by sending a specially crafted request to the /test endpoint on TCP port 9002. Because the service does not require any authentication, no username or password is needed to connect. Simply sending the correct malicious sequence to this port initiates the flaw. Normal operations that do not involve sending specifically formatted traffic to this internal service endpoint will not trigger the vulnerability.

Is my device at risk?

If your device is directly reachable from the internet, it is at higher risk. According to Halo Surface Signal, this charging station exposes a management service on TCP port 9002 that is often accessible remotely to facilitate connectivity. If you can reach this port from a public network, or if it is exposed on an internal network where traffic is not strictly controlled, the device is likely accessible to unauthorized remote commands.

What should I do first to secure my charger?

Start by identifying all Autel Maxi Charger Single units in your environment and verifying their network configuration. Determine if these devices are exposed to the public internet or are accessible from unauthorized segments of your network. Once you have an inventory, coordinate with your network or IT security teams to restrict access to TCP port 9002 immediately, then contact your vendor representative for guidance on firmware updates or configuration changes.

References

cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-m…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.