CVE-2026-8984
CWE-94Published: July 21, 2026· Updated: Jul 22, 2026
Official Description
Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges.
Risk Analysis
The Autel Maxi Charger Single firmware contains a critical flaw allowing unauthenticated remote code execution via the /test endpoint. An attacker can force the device to download and execute malicious files with root privileges.
No public exploit is known, and it is not listed in the CISA KEV catalog.
Apply the latest firmware updates and restrict access to the service listening on TCP port 9002.
Technical Analysis
CVE-2026-8984 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (1)
Quick Facts
Related CVEs (CWE-94)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-8984 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts