External risk intelligence

Autel Maxi Charger Heap Overflow Denial of Service and Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-8987

The vulnerability exists in the localcfg endpoint of an EV charger. While these devices are often networked, they are typically managed via internal local networks rather than being directly exposed to the public internet, though remote management features in some deployment scenarios make internet reachability possible.

Buffer Overflow

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a critical security flaw in Autel Maxi Charger Single firmware that could allow an authenticated attacker to disrupt service or potentially execute their own code by providing overly large input. The main concern is confirming if this specific technology is in use within our organization and, if so, to what extent.

Unauthorized input could disable chargers.
Critical flaw found in a specific charger model.
Confirm relevance and exposure of this technology.

Attack Path

How an attacker could exploit the issue

An attacker with low-level access to the Autel Maxi Charger can send specially crafted data to the local configuration endpoint. This data triggers a buffer overflow, which could lead to disruption of service or even allow the attacker to execute their own code on the device.

Requires authenticated access.
Triggered by oversized input to localcfg.
Risk of code execution or denial of service.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker with access to the `/localcfg` endpoint could exploit a heap-based buffer overflow in the `set_ap_param` command. This could disrupt the service's normal operation and potentially allow for arbitrary code execution when supported by the advisory.

Service availability.
Oversized input to specific command.
Denial of service, code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Autel Maxi Charger Single firmware vulnerability requires a coordinated response. Application owners or the platform team responsible for managing the charger's firmware are likely to address this. The first practical step involves identifying all deployed Maxi Charger units, confirming their network reachability and business criticality, and then engaging the appropriate teams for remediation planning.

Firmware owners should initiate discovery.
Verify charger network exposure and criticality.
Plan coordinated firmware updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Autel Maxi Charger Single?

The Autel Maxi Charger Single is an electric vehicle (EV) charging station designed to provide power for battery-operated cars. It utilizes internal firmware to manage charging operations and configuration settings. These units are typically deployed in residential or commercial settings where they must communicate over a network to allow owners or administrators to manage settings and monitor power consumption via local management interfaces.

What is the heap-based buffer overflow in CVE-2026-8987?

This is a memory corruption weakness categorized as CWE-122. It occurs when a program writes more data to a specific area of memory (the heap) than it is designed to hold. In this case, providing oversized input to the device's command interface overwrites adjacent memory, which can cause the software to crash, creating a denial of service, or potentially allowing an attacker to overwrite instructions and execute their own unauthorized code.

How is this vulnerability triggered in the charger?

The issue is triggered when a user sends specifically crafted, oversized data to the /localcfg endpoint while using the set_ap_param command. It is important to note that this flaw is not triggered by normal charging operations or routine status checks. It requires an attacker to already have valid authentication credentials to interact with the device's configuration settings.

Is my charger vulnerable if it is not on the internet?

According to Halo Surface Signal, while these chargers are often networked, they are typically managed on internal local networks rather than the public internet. However, if your specific deployment enables remote management features, the device could be reachable externally. You should assess whether your chargers are isolated from the internet or accessible via remote administrative portals to determine their specific risk profile.

What are the first steps to address CVE-2026-8987?

The immediate priority is discovery. Begin by identifying all deployed Autel Maxi Charger Single units within your environment. Once located, verify their network configuration to understand if they are accessible from untrusted networks. Engage the internal teams responsible for firmware management to confirm if your units are running affected firmware versions and to coordinate the necessary updates to secure the devices.

References

cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-m…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.