CVE-2026-8984 is a critical remote code execution vulnerability in Autel Maxi Charger Single firmware versions through V1.03.51. The vulnerability arises from improper handling of requests to the /test endpoint on a service listening on TCP port 9002. An attacker can send a specially crafted request that triggers the device to download, extract, and execute malicious files with root privileges without any authentication. This vulnerability is classified as CWE-94, indicating improper control over code generation or execution. No official patch or remediation guidance has been provided by the vendor as of the published date.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected device. This can lead to full compromise of the device, including control over its functions and potentially the network it is connected to. Given the critical CVSS score of 10.0 and the nature of the vulnerability, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to TCP port 9002 on the device to trusted sources only, and monitor for any suspicious activity targeting this service. Avoid exposing the device directly to untrusted networks.