PT-2026-62416
CVE-2026-8985
·
Published
2026-07-21
·
Updated
2026-07-21
Description by
CVSS 4.0
10
CriticalMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Name of the Vulnerable Software and Affected Versions
Autel Maxi Charger Single versions prior to V1.03.52
Description
An unauthenticated attacker can execute arbitrary operating system commands via OS command injection. This occurs through the '/test' endpoint exposed on TCP port 9002 by providing crafted input in the
url parameter.Recommendations
Update Autel Maxi Charger Single to a version newer than V1.03.51.
Avoid using the
url parameter in the '/test' endpoint until the issue is resolved.Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾