CVE-2026-8984

Name of the Vulnerable Software and Affected Versions Autel Maxi Charger Single versions prior to V1.03.52

Description Unauthenticated remote code execution is possible via the service listening on TCP port 9002. A crafted request to the '/test' endpoint allows the device to download, extract, and execute files controlled by an attacker with root privileges.

Recommendations Update Autel Maxi Charger Single to version V1.03.52 or later. Restrict access to the '/test' endpoint to minimize the risk of exploitation.