CVE-2026-8989

Awaiting Analysis Awaiting Analysis - Queue

Unrestricted Access to Recovery Mode in Autel Maxi Charger Single Firmware

Publication date: 2026-07-21

Last updated on: 2026-07-22

Assigner: CyberDanube

Description

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-22

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-8989

EUVD

EUVD-2026-46440

Affected Vendors & Products

Vendor	Product	Version / Range
autel	maxi_charger_single	to 1.03.51 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1244	The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal asset, providing unintended access to the asset from untrusted debug agents.
CWE-1191	The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

Attack-Flow Graph

Executive Summary

This vulnerability affects Autel Maxi Charger Single firmware versions through V1.03.51. It allows unrestricted access to the NXP i.MX6 recovery mode via exposed hardware recovery pins. An attacker with physical access can exploit this to boot malicious code in memory, potentially modifying or extracting firmware and sensitive data.

Detection Guidance

This vulnerability requires physical access to the device to exploit exposed hardware recovery pins. It cannot be detected remotely via network commands. Check for unauthorized physical access to the device or signs of tampering with the recovery pins.

Impact Analysis

If you own or use an Autel Maxi Charger Single with affected firmware, an attacker with physical access could gain control over the device. This may lead to unauthorized firmware changes, data theft, or further compromise of connected systems.

Compliance Impact

This vulnerability allows physical access to modify or extract sensitive data, which could lead to unauthorized data access or breaches. This may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if the device handles such data.

Mitigation Strategies

Restrict physical access to the device to authorized personnel only. Ensure the device is stored in a secure location. Regularly inspect the device for signs of tampering or unauthorized access.

Hi! I’m here to help you understand CVE-2026-8989. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70