The Autel Maxi Charger Single firmware through version V1.03.51 includes a hard-coded authentication token. This token bypasses authorization checks for multiple management endpoints, allowing attackers to supply the token value and gain privileged access without valid authentication. The vulnerability is identified as CWE-798 (Use of Hard-coded Credentials) and has a CVSS 3.1 base score of 9.8, indicating critical severity. No patch or remediation details are currently provided, and the affected versions are up to and including V1.03.51.

An attacker can leverage the hard-coded authentication token to bypass authorization and execute privileged operations on the device. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 9.8 reflects the critical impact, with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected devices and monitor for unauthorized access attempts. Avoid exposing the device management interfaces to untrusted networks.