Autel MaxiCharger EUVD-2026-46440

Exploitation requires direct physical access to the charger's internal circuit board and the ability to manipulate the exposed NXP i.MX6 hardware recovery/boot-mode pins to force the SoC into recovery (serial download) boot mode; this specific hardware condition IS the prerequisite, per the description. No authentication, credentials, user interaction, or non-default software configuration is needed once the attacker reaches the board (CVSS PR:N/UI:N, AC:L). The exploitation is fundamentally LIMITED by the Physical attack vector (AV:P): it cannot be performed remotely or over the network, cannot be automated at scale, and depends on the attacker being able to open or reach the device enclosure. It applies to MaxiCharger Single units running firmware through V1.03.51.

The CVSS 4.0 base score is 8.6 (High/Critical range), driven by full compromise of confidentiality, integrity, and availability on both the vulnerable and subsequent systems. The single strongest limiting factor is the Physical attack vector (AV:P): exploitation requires the attacker to physically open or access the charger's board and manipulate recovery pins, so this is not remotely exploitable and cannot be automated at internet scale. Against that, attack complexity is Low (AC:L), no privileges or user interaction are needed once physical access is obtained (PR:N/UI:N), and public exploit code exists - meaning any capable attacker with device access can reliably reproduce it. There is no EPSS score, no CISA KEV listing, and no evidence of active exploitation in the provided data, which is consistent with a physical-access hardware flaw: real risk is targeted (evil-maid, supply-chain interdiction, stolen/second-hand units, or an owner attacking their own leased unit) rather than mass exploitation. Net assessment: genuinely serious for physically accessible deployments and for firmware/key confidentiality, but the physical prerequisite substantially narrows the realistic threat compared to a network-exploitable 8.6.

An attacker with brief physical access to a wall- or pedestal-mounted MaxiCharger Single - for example a shared parking garage, a returned or resold unit, or an unattended public charger - opens the enclosure and straps the exposed i.MX6 recovery pins to force serial-download/recovery boot. Using the publicly available exploit method from CyberDanube, they stream their own code into memory to dump the stock firmware, extract embedded keys/credentials and configuration, and optionally write back trojanized firmware. Attack complexity is low once the case is open, so a knowledgeable attacker can complete extraction and implantation in a single visit.