Hiseeu C90 CVE-2026-36742

Physical access to the Hiseeu C90 device hardware is required. The attacker must be able to disconnect the battery (or trigger the same power-state condition through physical manipulation). The UART interface pins must be accessible - either directly exposed on the PCB or via a debug connector. No authentication or elevated user privileges are required once the debug mode is triggered. The vulnerability only manifests when the device is in this specific power state (battery disconnected); normal operation with battery installed does not expose the UART bootloader.

CVSS 6.8 with physical attack vector (AV:P) indicates this is a local privilege escalation requiring hands-on device access, not a network-exploitable flaw. The AC:L (low complexity) and lack of authentication requirements (PR:N) mean that once physical access is obtained, exploitation is straightforward. The confidentiality, integrity, and availability impacts are all high (C:H/I:H/A:H), indicating full system compromise. However, the physical attack vector significantly limits real-world risk compared to network-based vulnerabilities - only attackers with direct physical possession of the device can exploit this. EPSS and KEV data are not provided, and no public exploit code is confirmed. This is a privilege escalation vulnerability rather than an initial access vector, making it relevant primarily to threat models involving device theft, insider threats, or supply-chain tampering. The 'debug mode' classification suggests this may have been intentionally left for development/service purposes and inadequately disabled in production firmware.

An attacker with physical access to a Hiseeu C90 device removes the battery to trigger debug mode, then connects a serial interface (USB-to-UART adapter) to the device's UART pins. The bootloader responds with an unauthenticated prompt allowing direct memory reads/writes and firmware modification commands. The attacker uploads malicious firmware or modifies the running system to establish persistence, exfiltrate stored data, or use the device as a pivot point for further network attacks.