CVE-2026-8987 in MaxiCharger Single
Summary
by MITRE • 07/22/2026
Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentially arbitrary code execution.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The Autel Maxi Charger Single device presents a critical heap-based buffer overflow vulnerability within its firmware version 1.03.51 that resides in the set_ap_param command processing functionality. This flaw specifically manifests when the device handles requests through the /localcfg endpoint, which serves as a communication interface for local configuration management. The vulnerability stems from inadequate input validation mechanisms that fail to properly constrain the size of data submitted to the parameter setting function, creating an exploitable condition where maliciously crafted inputs can overwrite adjacent memory regions.
The technical nature of this vulnerability places it firmly within the CWE-121 heap-based buffer overflow category, which represents a classic memory corruption flaw that enables attackers to manipulate program execution flow. When an authenticated attacker submits oversized input data to the set_ap_param command through the /localcfg endpoint, the device's memory management routines fail to properly handle the excessive payload. This condition allows for arbitrary memory overwrite operations that can corrupt the heap structure and potentially overwrite critical program variables, function pointers, or return addresses.
The operational impact of this vulnerability extends beyond simple denial of service scenarios into more severe security implications including potential arbitrary code execution capabilities. The device's authenticated access requirement means that exploitation necessitates valid credentials, but once achieved, attackers could leverage the buffer overflow to execute malicious code within the device's operational environment. This capability enables various attack vectors including persistent backdoor installation, data exfiltration from connected systems, or further network compromise through lateral movement.
From an adversarial perspective, this vulnerability aligns with ATT&CK technique T1059.007 for command and scripting interpreter execution, as successful exploitation could allow attackers to establish persistent access points on the device. The vulnerability also maps to T1210 exploitation of remote services, since it represents a remotely accessible attack surface that can be targeted through network-based communication protocols. Security professionals should recognize this issue as part of a broader class of firmware vulnerabilities that commonly affect IoT and embedded systems where input validation controls are insufficiently implemented.
The recommended mitigation strategies include immediate firmware updates from the vendor to address the identified heap overflow condition, along with network segmentation to limit access to the device's configuration endpoints. Additionally, implementing strict input validation mechanisms at the application level, deploying intrusion detection systems to monitor for anomalous traffic patterns, and establishing regular security assessments of embedded device configurations will help reduce the overall risk exposure. Organizations should also consider implementing authentication controls that follow zero-trust principles, ensuring that even authenticated users have least-privilege access to critical system functions while maintaining detailed audit logs of configuration changes.