CVE-2026-8989

Open Recovery Mode

State: Published
Severity: 8.6 High
Published: Jul 21, 2026
Updated: Jul 22, 2026
Reserved: May 19, 2026

Description

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	CyberDanube

Weaknesses

CWE-1191 On-Chip debug and test interface with improper access control
CWE-1244 Internal asset exposed to unsafe debug access level or state

Affected Products

Product	Versions
MaxiCharger SingleAutel	V1.03.51 and earlierAffected

References

https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/third-party-advisoryexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.