Executive brief
Autel MaxiCharger electric vehicle charging stations are vulnerable to a security flaw that allows a malicious or compromised management server to take control of the device. By sending a specially crafted diagnostic request, an attacker can execute unauthorized commands on the charger's operating system. This could lead to a complete compromise of the charging infrastructure, potentially allowing attackers to disrupt service or access sensitive configuration data.
Technical details
An OS command injection vulnerability exists in the Autel MaxiCharger Single firmware (up to V1.03.51) within the handling of Open Charge Point Protocol (OCPP) GetDiagnostics requests. The vulnerability occurs because the 'location' parameter (URL) provided in the GetDiagnostics command is passed to a system-level execution function without adequate sanitization. An attacker who controls the OCPP server or performs a man-in-the-middle attack can inject shell commands into the URL (e.g., using command substitution syntax like $(whoami)). Successful exploitation results in arbitrary command execution with high privileges on the underlying Linux operating system.
Affected products
- Autel MaxiCharger Single through V1.03.51
Timeline
- 2026-07-21: advisory: NVD publication date
- 2026-09-06: disclosed: CyberDanube research published