CVE-2026-8985 describes an OS command injection vulnerability (CWE-78) in the Autel Maxi Charger Single firmware through version 1.03.51. The vulnerability exists in the /test endpoint exposed on TCP port 9002, where an unauthenticated attacker can provide malicious input via a URL parameter to execute arbitrary OS commands. This can lead to full system compromise. The vulnerability has a CVSS 4.0 score of 10, indicating critical severity. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to execute arbitrary operating system commands on the affected device, potentially leading to full system compromise, data loss, or disruption of device functionality. Given the critical CVSS score, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to TCP port 9002 to trusted users only and monitor for suspicious activity targeting the /test endpoint.