CVE-2026-8985

The CVSS 9.8 rating for CVE-2026-8985 is technically accurate but masks a deeper problem: this is not merely a code defect, it's a deployment and process failure. The /test endpoint on port 9002 was never supposed to exist in production firmware—it is abandoned debug infrastructure, a diagnostic tool left running after development concluded. That it executes OS commands via URL parameter is almost secondary to the fact that it shipped at all. The pattern is not unique to Autel. The same genetic sequence appears across IP cameras with telnet backdoors (2014-2017), SOHO routers with hidden admin accounts, and industrial PLCs with hardcoded diagnostic ports. The command injection via URL parameter is a mutation we've traced through CGI scripts in the early 2000s, through embedded web servers in the 2010s, and now through IoT management interfaces. What changes is the consequence: EV chargers are convergence points where home networks, vehicle telemetry, building automation, and increasingly the electrical grid intersect. Command execution on a charger is no longer just a network compromise—it is potential pivot to physical infrastructure impact. The 'through V1.03.51' version language is the most dangerous ambiguity. If this means the endpoint persists in newer firmware—if the highest-known-affected version is simply the highest someone bothered to check—then the debug surface may remain in current deployments. Organizations that patched assuming removal may be operating on unverified faith. Debug code that was never supposed to ship doesn't get 'fixed' conventionally; it gets excised, or it doesn't. Assume the endpoint is present until proven otherwise. Isolate these devices network-wise. Treat the firmware update process itself as a security gap—if you cannot reliably patch deployed units, that is itself a structural risk. The CVSS captures the wound; it tells you nothing about whether the rot has been cut out.

Reviewed through automated stages and approved by a human before publication.