This vulnerability (CVE-2026-8982) affects Autel MaxiCharger Single firmware versions up to V1.03.51. It arises from the presence of two undocumented privileged accounts whose passwords are derived using a vendor-specific algorithm based on device-specific values. Knowledge of this algorithm and inputs allows an attacker to bypass authentication and gain administrative access to the web management interface without authorization. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials). No official patch or remediation level has been published by the vendor as of the data provided.

An attacker with knowledge of the password derivation algorithm and device-specific inputs can gain administrative privileges on the affected device remotely via the web management interface. This unauthorized access could allow full control over the device, potentially leading to device manipulation or disruption of its intended functions. The CVSS 4.0 base score is 10, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only and monitor for unauthorized access attempts. Avoid exposing the device management interface to untrusted networks. Follow vendor communications for updates on patches or official mitigations.