CVE-2026-8983 identifies a critical vulnerability in Autel Maxi Charger Single firmware through version V1.03.51 where a hard-coded authentication token is present. This token bypasses authorization checks on multiple management endpoints, allowing an unauthenticated attacker to perform privileged operations. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials) and has a CVSS 4.0 base score of 10, indicating maximum severity. There is currently no official fix or patch available, and no known exploits in the wild have been reported.

An attacker can leverage the hard-coded token to bypass all authorization controls on affected management endpoints, gaining unauthorized privileged access. This could lead to full compromise of the device's management functions, potentially allowing configuration changes, disruption of service, or other malicious actions. The vulnerability affects confidentiality, integrity, and availability with high impact metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device to trusted administrators only and monitor for any unusual management activity. Avoid exposing the device management interfaces to untrusted networks.