Skip to main content

Autel MaxiCharger CVE-2026-8989

| EUVDEUVD-2026-46440 HIGH
On-Chip Debug and Test Interface With Improper Access Control (CWE-1191)
2026-07-21 CyberDanube GHSA-wpf3-8j9v-2qg2
Information Disclosure Maxicharger Single
8.6
CVSS 4.0 · Vendor: CyberDanube
Share

Severity by source

Vendor (CyberDanube) PRIMARY
8.6 HIGH
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.6 HIGH

Physical access to recovery pins (AV:P) with no auth/UI (PR:N/UI:N); code runs pre-boot bypassing firmware trust boundary (S:C) with full C/I/A loss.

3.1 AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 21, 2026 - 22:06 vuln.today
CVE Published
Jul 21, 2026 - 21:24 cve.org
HIGH 8.6

DescriptionCVE.org

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data.

AnalysisAI

Physical firmware compromise in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets an attacker with hands-on access exploit exposed NXP i.MX6 hardware recovery pins to boot unsigned, attacker-controlled code into memory. Once in recovery mode the attacker can dump, modify, or replace the device firmware and extract sensitive data such as credentials, keys, or configuration. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain physical access to charger enclosure
Delivery
Expose and strap i.MX6 recovery pins
Exploit
Force NXP serial-download/recovery boot
Execution
Boot attacker-controlled code in memory
Persist
Dump and modify firmware and secrets
Impact
Flash trojanized firmware / exfiltrate data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires direct physical access to the charger's internal circuit board and the ability to manipulate the exposed NXP i.MX6 hardware recovery/boot-mode pins to force the SoC into recovery (serial download) boot mode; this specific hardware condition IS the prerequisite, per the description. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score is 8.6 (High/Critical range), driven by full compromise of confidentiality, integrity, and availability on both the vulnerable and subsequent systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with brief physical access to a wall- or pedestal-mounted MaxiCharger Single - for example a shared parking garage, a returned or resold unit, or an unattended public charger - opens the enclosure and straps the exposed i.MX6 recovery pins to force serial-download/recovery boot. Using the publicly available exploit method from CyberDanube, they stream their own code into memory to dump the stock firmware, extract embedded keys/credentials and configuration, and optionally write back trojanized firmware. …
Remediation No vendor-released patch version is identified in the available data, and because the root cause is exposed hardware recovery pins on the NXP i.MX6, a firmware update alone may not fully close the recovery-mode path unless it also enables secure/signed boot fusing. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Audit all Autel MaxiCharger Single installations, document locations and quantities, and inventory what credentials, keys, or sensitive configuration data are stored on each device. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Maxicharger Single

View all
CVE-2026-8985 CRITICAL POC
10.0 Jul 21

Unauthenticated OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a
CVE-2026-8984 CRITICAL POC
10.0 Jul 21

Remote code execution in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets unauthenticated

CVE-2026-8983 CRITICAL POC
10.0 Jul 21

Authentication bypass in Autel MaxiCharger Single EV charging stations running firmware up to and including V1.03.51 let
CVE-2026-8982 CRITICAL POC
10.0 Jul 21

Authentication bypass via hard-coded backdoor accounts in Autel MaxiCharger Single EV charging stations (firmware throug
CVE-2026-8986 CRITICAL POC
9.5 Jul 21

OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a malicious or co
CVE-2026-8987 CRITICAL POC
9.4 Jul 21

Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1
CVE-2026-8988 HIGH POC
8.6 Jul 21

Physical compromise of Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 is possible via a

Same weakness CWE-1191 – On-Chip Debug and Test Interface With Improper Access Control

View all
CVE-2026-8988 HIGH POC
8.6
CVE-2022-43096 MEDIUM POC
6.8
CVE-2024-48970 CRITICAL
9.3
CVE-2024-41692 HIGH
8.6
CVE-2025-26409 MEDIUM
6.8
CVE-2024-4231 MEDIUM
6.8
CVE-2025-47822 MEDIUM
6.4
CVE-2025-47819 MEDIUM
6.4

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2023-4966 HIGH POC
7.5

Share

CVE-2026-8989 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy