Threats tagged 'ghsa-9qpp-vgrg-5mhj'

Autel Maxi Charger Single firmware versions up to and including V1.03.51 contain a critical vulnerability that allows unauthenticated remote code execution. The flaw exists in a service listening on TCP port 9002, where a crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges. This vulnerability has a CVSS score of 9.8, indicating a critical severity level.