External risk intelligence

Autel Maxi Charger OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-8986

The vulnerability affects an electric vehicle charging station that communicates via OCPP (Open Charge Point Protocol). These devices are typically deployed in public-facing or externally reachable locations to communicate with backend management servers over the internet, making the interface exposed to network-based interaction.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects Autel Maxi Charger Single devices, allowing attackers to execute arbitrary commands on the charging station through a compromised or malicious server. The issue stems from how the device processes specific diagnostic requests, potentially leading to unauthorized control over charging infrastructure.

Malicious servers can control charging stations.
Critical vulnerability impacts charging station control.
Confirm relevance and potential exposure of devices.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by controlling a charging station's backend server. This server, using the Open Charge Point Protocol, can send a specially crafted URL to the charging station. When the station processes this URL in a diagnostics request, it can be tricked into running arbitrary commands on its operating system.

Network access required.
Crafted diagnostics request triggers vulnerability.
Leads to arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

An attacker controlling an OCPP server could exploit this vulnerability by sending a specially crafted diagnostics URL to the charging station. This could lead to arbitrary command execution on the device, potentially impacting its operational integrity.

Charging station operating system.
Malicious URL via OCPP server.
Arbitrary command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Autel Maxi Charger firmware, allowing arbitrary command execution, likely requires coordination between the charging station's asset owner and the vendor to address. The first practical step is to identify all deployed charging stations, confirm their network exposure and business criticality, and then engage the vendor for a secure firmware update.

Own by charging station asset owner.
Verify network exposure and criticality.
Coordinate vendor firmware update.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Autel Maxi Charger Single?

The Autel Maxi Charger Single is an electric vehicle charging station designed to provide power to EVs. It uses the Open Charge Point Protocol (OCPP) to communicate with backend management systems over a network, enabling features like remote diagnostics, status monitoring, and energy management coordination between the station and its operator.

How does CVE-2026-8986 lead to arbitrary command execution?

This vulnerability is an OS command injection, identified as CWE-78. It happens because the charging station fails to properly sanitize input when processing 'GetDiagnostics' requests. When a server sends a malicious URL string, the charger's operating system mistakenly executes the attacker's embedded instructions as if they were legitimate system commands.

Does any OCPP request trigger this vulnerability?

No. The vulnerability is specific to the handling of diagnostics-related requests. Other standard OCPP messages used for routine charging functions do not involve the specific URL processing logic that allows this command injection, meaning general charging activity remains distinct from the trigger path for this flaw.

Why should I care about this if my chargers are internal?

Halo Surface Signal notes that these devices are often placed in public or externally reachable locations to communicate with backend servers. If your charging stations communicate with a server over the internet, they are at higher risk. Even if they are on an internal network, a compromised backend server acting as a middleman could still reach and exploit the devices.

What is the first step to address this CVE?

Begin by creating an inventory of all your deployed Autel Maxi Charger units to determine which ones are running the affected firmware versions up to V1.03.51. Once identified, evaluate their network connectivity and reachability, then reach out to the vendor to coordinate the necessary firmware updates to patch the command injection vulnerability.

References

cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-m…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.