The Autel Maxi Charger Single firmware through version V1.03.51 is affected by an OS command injection vulnerability (CWE-78) when handling OCPP GetDiagnostics requests. An attacker controlling or compromising the OCPP server can craft a diagnostics URL that triggers arbitrary command execution on the charging station. This vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no information about an available patch or official remediation from the vendor at this time.

Successful exploitation results in full compromise of the charging station device, allowing an attacker to execute arbitrary operating system commands remotely. This can lead to complete loss of confidentiality, integrity, and availability of the affected device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the OCPP server and monitor for suspicious activity related to GetDiagnostics requests. Consider isolating affected devices from untrusted networks to reduce exposure.