Autel MaxiCharger EUVD-2026-46440

No vendor-released patch version is identified in the available data, and because the root cause is exposed hardware recovery pins on the NXP i.MX6, a firmware update alone may not fully close the recovery-mode path unless it also enables secure/signed boot fusing. Prioritize physical security as the primary compensating control: restrict and monitor physical access to deployed chargers (locked enclosures, tamper-evident seals, camera coverage, siting units in supervised locations), since the attack is impossible without hands-on access. Where the vendor supports it, enable NXP High Assurance Boot / secure boot and blow the corresponding security fuses so the processor rejects unsigned recovery images - note this is typically an irreversible provisioning step and can brick or lock devices if done incorrectly, and may not be field-configurable on already-deployed units. Assume that any charger which has been physically accessed by an untrusted party (e.g., second-hand, returned, or interdicted units) may have compromised firmware and extracted secrets, and rotate any device-stored credentials/keys accordingly. Consult the vendor and the CyberDanube advisory (https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/) for an official fixed firmware release before relying on a software patch.