MaxiCharger Single vulnerabilities
6 known vulnerabilities in MaxiCharger Single from Autel. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
MaxiCharger Single: Heap-based Buffer Overflow
Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentially arbitr
- 9.8 Critical severity
MaxiCharger Single: Improper Neutralization of Special Elements used in an OS Command
Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on t
- 9.8 Critical severity
MaxiCharger Single: Improper Neutralization of Special Elements used in an OS Command
Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.
- 9.8 Critical severity
MaxiCharger Single: Improper Control of Generation of Code
Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled file
- 9.8 Critical severity
MaxiCharger Single: Use of Hard-coded Credentials
Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to invoke privileged functionality without valid
- 8.1 High severity
MaxiCharger Single: Use of Hard-coded Credentials
Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required