The Autel Maxi Charger Single firmware versions through 1.03.51 are affected by a heap-based buffer overflow vulnerability (CWE-122) in the set_ap_param command processed by the /localcfg endpoint. An attacker with authentication privileges can exploit this by sending oversized input, leading to denial of service and possibly arbitrary code execution. The vulnerability is tracked as CVE-2026-8987 and has a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation can result in denial of service and potentially allow an attacker to execute arbitrary code with the privileges of the vulnerable service. Confidentiality, integrity, and availability of the affected device can be fully compromised. The attacker must be authenticated to trigger the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated access to the /localcfg endpoint and monitor for suspicious activity related to the set_ap_param command.