CVE WatchJul 21, 2026

CVE-2026-8989

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware reco

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0-100

Published: Jul 21, 2026 · Last modified: Jul 21, 2026 · CWE-1191 · CWE-1244

EPSS · 30d

Not enough EPSS history yet.

Technical description

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data.

Official references

cyberdanube.comhttps://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-8988—

—

——0Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An attacker with physical access can modify the boot configuration or file system to obtain operating system access.12h CVE-2025-678626.7 MED

4.6%

——1An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0 all versions may allow an authenticated admin to execute lua scripts via crafted CLI commands.8d