CVE-2026-8989

The record

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data.

Affected packages

Related vulnerabilities

• CVE-2026-15203 Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP… CWE-1191
• CVE-2026-8988 Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface… CWE-1191
• CVE-2025-52533 Improper Access Control in an on-chip debug interface could allow a privileged attacker… CWE-1191
• CVE-2024-36319 Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a… CWE-1191
• CVE-2025-15083 A vulnerability was determined in TOZED ZLT M30s up to 1.47. CWE-1191
• CVE-2025-36755 The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically… CWE-1191
• CVE-2025-67862 An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244]… CWE-1244
• CVE-2026-29642 A local attacker who can execute privileged CSR operations (or can induce firmware to do… CWE-1244