External risk intelligence

Autel Maxi Charger OS Command Injection.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-8985

The vulnerability affects an EV charging station's firmware via an endpoint on TCP port 9002. While these devices may be deployed in various network configurations, they are often designed to be internet-connected for remote management, billing, and status monitoring, making the exposed service a likely target for remote network access.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability allows any unauthenticated attacker on the network to inject malicious commands into Autel Maxi Charger firmware, potentially leading to a complete system compromise. The issue lies in how the device handles specific URL inputs on a port typically used for management or communication. While the direct business impact requires confirming device deployment and network exposure, this type of vulnerability could theoretically allow unauthorized control or disruption of charging infrastructure.

Unauthenticated network attackers can run commands.
Critical vulnerability in EV charging station firmware.
Confirm relevance and potential exposure of affected devices.

Attack Path

How an attacker could exploit the issue

An attacker can target the Autel Maxi Charger Single by sending specially crafted input to its `/test` endpoint. This endpoint is accessible over the network on TCP port 9002, and it does not require any authentication. By manipulating the `url` parameter, an attacker can inject operating system commands, potentially leading to a complete compromise of the device.

Entry Condition: Attacker has network access to the device.
Trigger Point: Sending a crafted request to the `/test` endpoint.
Resulting Risk: Arbitrary OS command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary operating system commands on the affected device when its web interface is accessible over the network.

System commands could be executed.
Via network access to the device.
Device compromise and potential disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Autel Maxi Charger Single firmware vulnerability requires immediate attention from teams responsible for operational technology (OT) and device management. The first step is to identify all deployed Maxi Charger Single units, determine their network exposure and criticality, and pinpoint the accountable owner for each device to plan remediation.

Own the vulnerability and remediation planning.
Verify network exposure and device criticality.
Coordinate vendor engagement for firmware updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Autel Maxi Charger Single?

The Autel Maxi Charger Single is an electric vehicle (EV) charging station. These devices typically integrate with network systems to handle remote functions like billing, status monitoring, and energy management, requiring them to stay connected to local or internet-based networks for ongoing operations.

What does CVE-2026-8985 mean?

This vulnerability is an OS command injection, categorized as CWE-78. It means the software fails to safely sanitize user-provided input before using it to execute system-level instructions. Because of this flaw in CVE-2026-8985, an attacker can input malicious code that the charger will run as if it were a legitimate command, giving them unauthorized control over the device's operating system.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted request to the /test endpoint on TCP port 9002. Authentication is not required to reach this endpoint. Crucially, the vulnerability only exists when the device is accessible via network traffic directed to that specific port; it cannot be triggered if the device is isolated from the network or if traffic to port 9002 is strictly blocked by a firewall.

Is my device at risk?

Halo Surface Signal indicates that because this charger often requires network connectivity for management and billing, it is a likely target for remote access. If your unit is configured to be internet-facing or is reachable on an internal network where an attacker can access port 9002, the device is considered exposed and at higher risk of being targeted.

What are the first steps to respond?

You should immediately inventory your deployed Autel Maxi Charger Single units to determine how many are active and where they are located. Verify the network configuration for each device to see if port 9002 is reachable from outside your protected environment. Simultaneously, identify the owner of these assets and reach out to the vendor to coordinate the application of official firmware updates.

References

cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-m…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.