Autel vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-13308 Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability.High 8.1 · Jul 29, 2026
• CVE-2026-8989 Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins.High 8.6 · Jul 21, 2026
• CVE-2026-8988 Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot High 8.6 · Jul 21, 2026
• CVE-2026-8987 Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint.Critical 9.4 · Jul 21, 2026
• CVE-2026-8986 Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests.Critical 9.5 · Jul 21, 2026
• CVE-2026-8985 Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002.Critical 10 · Jul 21, 2026
• CVE-2026-8984 Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002.Critical 10 · Jul 21, 2026
• CVE-2026-8983 Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoiCritical 10 · Jul 21, 2026
• CVE-2026-8982 Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51.Critical 10 · Jul 21, 2026
• CVE-2025-6678 Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability.High 7.5 · Jun 25, 2025
• CVE-2025-5830 Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability.High 8.8 · Jun 25, 2025
• CVE-2025-5827 Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability.High 8.8 · Jun 25, 2025
• CVE-2025-5825 Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability.High 7.5 · Jun 25, 2025
• CVE-2025-5824 Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability.High 7.5 · Jun 25, 2025
• CVE-2025-5822 Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability.High 8.8 · Jun 25, 2025
• CVE-2024-23967 Autel MaxiCharger AC Elite Business C50 WebSocket Base64 Decoding Stack-based Buffer Overflow Remote Code Execution Vulnerability.High 8 · Sep 28, 2024
• CVE-2024-23959 Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl Stack-based Buffer Overflow Remote Code Execution Vulnerability.High 8 · Sep 28, 2024
• CVE-2024-23957 Autel MaxiCharger AC Elite Business C50 DLB_HostHeartBeat Stack-based Buffer Overflow Remote Code Execution Vulnerability.High 8.8 · Sep 28, 2024
• CVE-2024-7795 Autel MaxiCharger AC Elite Business C50 AppAuthenExchangeRandomNum Stack-Based Buffer Overflow Remote Code Execution Vulnerability.High 8.8 · Aug 21, 2024