Vulnerability · Published Jul 21, 2026 · Assigned by CyberDanube

CVE-2026-8982Hard-coded / Backdoor Accounts

Critical 10.0

In plain English

A critical-severity hard-coded credentials in MaxiCharger Single from Autel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 4.0)10.0Critical

Exploit odds (30 days)0.5%top 58.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web management interface with administrative privileges.

Affected products (as reported)

Vendor	Product	Versions
Autel	MaxiCharger Single	0 – through V1.03.51

Weakness: CWE-798 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/ third-party-advisory, exploit