Autel vulnerabilities
We track 18 vulnerabilities in Autel products across 14 products. 18 are rated high or critical, and none are known to be exploited. The most recent was published on July 29, 2026.
Latest Autel vulnerabilities
- 8.1 High severity
MaxiCharger AC Elite Home: Integer Underflow (Wrap or Wraparound)
Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is n
- 8.8 High severity
MaxiCharger Single: Heap-based Buffer Overflow
Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentially arbitr
- 9.8 Critical severity
MaxiCharger Single: Improper Neutralization of Special Elements used in an OS Command
Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on t
- 9.8 Critical severity
MaxiCharger Single: Improper Neutralization of Special Elements used in an OS Command
Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.
- 9.8 Critical severity
MaxiCharger Single: Improper Control of Generation of Code
Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled file
- 9.8 Critical severity
MaxiCharger Single: Use of Hard-coded Credentials
Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to invoke privileged functionality without valid
- 8.1 High severity
MaxiCharger Single: Use of Hard-coded Credentials
Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required
- 7.5 High severity
Autel MaxiCharger AC Wallbox Commercial: Missing Authentication for Critical Functionality
Autel MaxiCharger AC Wallbox Commercial PIN Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial charging
- 8.8 High severity
Autel MaxiCharger AC Wallbox Commercial: Heap-based Buffer Overflow
Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox C
- 8.8 High severity
Autel MaxiCharger AC Wallbox Commercial: Stack-based Buffer Overflow
Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wall
- 7.5 High severity
Autel MaxiCharger AC Wallbox Commercial: Security Version Number Mutable to Older Versions
Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial charging station
- 7.5 High severity
Autel MaxiCharger AC Wallbox Commercial: Origin Validation Error
Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker
- 8.8 High severity
Autel MaxiCharger AC Wallbox Commercial: Incorrect Authorization
Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging s
- 8.0 High severity
MaxiCharger AC Elite Business C50: Out-of-bounds Write
Autel MaxiCharger AC Elite Business C50 WebSocket Base64 Decoding Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC
- 8.0 High severity
MaxiCharger AC Elite Business C50: Out-of-bounds Write
Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Eli
- 8.8 High severity
MaxiCharger AC Elite Business C50: Use of Hard-coded Credentials
Autel MaxiCharger AC Elite Business C50 BLE Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Business C50 charging s
- 8.8 High severity
MaxiCharger AC Elite Business C50: Out-of-bounds Write
Autel MaxiCharger AC Elite Business C50 DLB_HostHeartBeat Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Bu
- 8.8 High severity
MaxiCharger AC Elite Business C50: Improper Restriction of Operations within the Bounds of a Memory Buffer
Autel MaxiCharger AC Elite Business C50 AppAuthenExchangeRandomNum Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC