An unauthenticated OS command injection vulnerability in the Autel MaxiCharger Single firmware allows attackers to execute arbitrary system commands with full privileges.

This is an OS command injection vulnerability (CWE-78) located in the /test endpoint of the device firmware. The vulnerability is exploitable by an unauthenticated attacker who can send crafted input to the url parameter to achieve remote code execution.

Successful exploitation grants an attacker full control over the charging station, which may lead to complete system compromise, the potential for lateral movement into the local network, or disruption of charging services. Given the CVSS score of 10.0, this represents a critical risk that could lead to physical damage or significant operational downtime for deployed infrastructure.

Immediate Action: Update the Autel MaxiCharger Single firmware to a version beyond V1.03.51 as soon as a patch is released by the vendor.

Proactive Monitoring: Inspect network traffic directed at TCP port 9002 for unusual payloads or attempts to access the /test endpoint.

Compensating Controls: Implement strict network segmentation to isolate charging infrastructure and utilize a Web Application Firewall (WAF) or equivalent network filter to block unauthorized access to the management interface.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a maximum-severity risk to operational technology environments. Administrators must prioritize the application of vendor-supplied firmware updates immediately upon availability to prevent unauthorized remote access and system takeover.