# CVE-2026-8982: Autel MaxiCharger Single undocumented privileged accounts

Source: https://junglewise.ai/threats/cve-2026-8982-autel-maxicharger-single-undocumented-privileged-accounts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-8982 · Severity: info · CVSS 10 · Published 2026-07-21

The Autel MaxiCharger Single, an electric vehicle charging station, contains two undocumented administrative accounts. These accounts allow anyone with knowledge of the manufacturer's password generation method to log into the charger's web management interface with full administrative privileges. An attacker could use this access to change device configurations, disrupt charging services, or gain a foothold in the local network.

Technologies: [Autel MaxiCharger Single](https://junglewise.ai/threats/technologies/maxicharger-single). Vendors: [Autel](https://junglewise.ai/threats/vendors/autel).

## Quick answers

**Is CVE-2026-8982 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8982 being exploited in the wild.

**How severe is CVE-2026-8982?** Informational severity, with a CVSS score of 10, published 21 July 2026.

**Which products and versions are affected?** Autel MaxiCharger Single through V1.03.51.

**Is there a fix for CVE-2026-8982?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8982 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8982?** Check whether you run Autel MaxiCharger Single at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Autel MaxiCharger Single firmware (up to V1.03.51) contains two undocumented accounts: 'super_admin' and 'config_admin'. These accounts utilize a vendor-defined password derivation mechanism (CWE-798) based on device-specific values such as a 6-digit PIN, MAC address, and serial number. The 'super_admin' account is particularly vulnerable as its password can be derived from a 6-digit PIN that is easily guessable or brute-forced. An unauthenticated attacker with network access to the web management interface can use these derived credentials to gain administrative control over the device. This vulnerability was disclosed alongside several other critical flaws in the same product line, including unauthenticated RCE and command injection.

## Affected products

- Autel MaxiCharger Single through V1.03.51

## Timeline

- 2026-07-21: advisory: NVD publication date
- 2026-09-06: disclosed: CyberDanube security research published

## References

- [https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/](https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/)

## Related threats

- [Autel MaxiCharger Single unrestricted recovery mode access via hardware pins](https://junglewise.ai/threats/cve-2026-8989-autel-maxicharger-single-unrestricted-recovery-mode-access-via)
- [Autel MaxiCharger Single bootloader access via UART interface](https://junglewise.ai/threats/cve-2026-8988-autel-maxicharger-single-bootloader-access-via-uart-interface)
- [Autel MaxiCharger Single heap overflow in set_ap_param command](https://junglewise.ai/threats/cve-2026-8987-autel-maxicharger-single-heap-overflow-in-set-ap-param-command)
- [Autel MaxiCharger Single OS command injection in OCPP GetDiagnostics](https://junglewise.ai/threats/cve-2026-8986-autel-maxicharger-single-os-command-injection-in-ocpp)
- [Autel MaxiCharger Single OS command injection in /test endpoint](https://junglewise.ai/threats/cve-2026-8985-autel-maxicharger-single-os-command-injection-in-test-endpoint)