Autel MaxiCharger EUVD-2026-46437

Exploitation requires direct physical access to the charger's circuit board and the exposed, unauthenticated UART/serial interface, plus the ability to interrupt U-Boot's autoboot sequence (the bootloader must permit boot interruption, which it does on firmware through V1.03.51). No credentials, no user interaction, and no network connectivity are needed once the attacker is at the serial console. Limiting factors: the attack cannot be performed remotely (AV:P) - the attacker must be on-site and typically must open the enclosure to reach the UART header - and it is confined to devices running firmware V1.03.51 or earlier; enclosure tampering may be detectable and physical siting/monitoring can materially raise the difficulty.

The vendor CVSS 4.0 score of 8.6 (High) is driven by a full high impact to confidentiality, integrity and availability of both the vulnerable charger and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) combined with low attack complexity and no privilege or user-interaction requirement. The single most important tempering factor is the physical attack vector (AV:P): an attacker must be physically present at the device and open/access the board to reach the UART header. There is no EPSS score, KEV listing, or SSVC decision data provided, so automated/remote exploitation probability cannot be quantified - but note that EPSS/KEV are largely irrelevant here because the flaw is not network-reachable and therefore not amenable to mass, automated exploitation. This is a real risk for the specific threat model of tampering, roadside/kerbside, or supply-chain physical attacks on unattended charging hardware, rather than a remote internet-facing emergency. Public exploit code exists, lowering the skill barrier for anyone who does obtain physical access. Note: the tags label this 'Information Disclosure,' but the description and CVSS integrity/availability impacts indicate full device takeover, not merely data disclosure - the tag understates the impact.

An attacker with brief physical access to a publicly sited MaxiCharger Single opens the enclosure, connects a USB-to-serial adapter to the exposed UART header, and interrupts the boot countdown to reach the U-Boot prompt. Using the publicly available exploit method, they modify the kernel command line or root filesystem to spawn a root shell, obtaining full OS access to read stored credentials/certificates, alter charging or billing logic, or implant persistent malicious firmware.