CVE-2026-8982
High · 8.1CVSS
8.1
EPSS
0.5%
Published
Jul 21, 2026
CISA due date
—
The record
Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web management interface with administrative privileges.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-7003 WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that… CWE-798
- CVE-2026-61729 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-798
- CVE-2026-119662 Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows… CWE-798
- CVE-2026-111419 A sensitive information exposure vulnerability exists on the Foxit official website… CWE-798
- CVE-2026-118601 Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. CWE-798
- CVE-2026-18449 The BMC does not correctly enforce integrity and encryption requirements for IPMI… CWE-798
- CVE-2026-54631 Part-DB is an open source inventory management system for electronic components. CWE-798
- CVE-2026-92450 The authentication framework used by affected Kiloview E3 NDI encoder firmware signs… CWE-798