A hard-coded authentication token in the Autel MaxiCharger Single firmware allows unauthenticated users to bypass security controls and access sensitive management functions.

This is an authentication bypass vulnerability (CWE-798) resulting from the use of a hard-coded token. This token permits an attacker to invoke administrative functions without performing a standard login process.

By bypassing authentication, an attacker can gain full control over the management functions of the device. The ability to perform privileged operations without credentials poses a catastrophic risk to the security of the device and the network it resides on, justifying its critical CVSS score of 10.0.

Immediate Action: Apply the vendor-provided firmware update that removes the hard-coded token and restores proper authentication requirements.

Proactive Monitoring: Monitor logs for requests to management endpoints that contain unexpected or static token values in the headers or parameters.

Compensating Controls: Use network-level access controls to ensure that the web management interface is not exposed to the public internet or untrusted internal segments.

Public Exploit Available: No (exploit_available: false)

This vulnerability allows for a complete bypass of the device security model. It is imperative that users update their firmware to the latest version to eliminate this hard-coded token and restore the integrity of the device authentication process.