First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-8983

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to invoke privileged functionality without valid authentication.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Autel	MaxiCharger Single	<= V1.03.51

References

https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/Exploit, Third Party Advisory

Timeline

Published: Jul 21, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-89830In the Linux kernel, the following vulnerability has been resolved: f2fs: fix valid block count leak on data block allocation failure In _CVE-2026-89831In the Linux kernel, the following vulnerability has been resolved: f2fs: protect critical_task_priority updates with s_umount The sysfs s CVE-2026-898327.8In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is CVE-2026-89833In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() There CVE-2026-89834In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during free_segment_range In fre CVE-2026-89835In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge ca CVE-2026-898367.8In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folio_nr_pages() race after put in large folio invalidate Ou CVE-2026-89837In the Linux kernel, the following vulnerability has been resolved: f2fs: fix dentry folio leak in find_in_level find_in_level() gets a de CVE-2026-898387.1In the Linux kernel, the following vulnerability has been resolved: f2fs: limit recovery filename logging to stored length F2FS stores rec CVE-2026-89839In the Linux kernel, the following vulnerability has been resolved: f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set(CVE-2026-89849.8Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002.CVE-2026-898407.1In the Linux kernel, the following vulnerability has been resolved: f2fs: validate MOVE_RANGE destination size F2FS_IOC_MOVE_RANGE checks

CVE-2026-8983: Critical severity, CVSS 9.8 | Vulnix