CVE-2026-8989: Autel MaxiCharger Single, заобикаляне на вход и права

Описание

Оригинално описание

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data.

Засегнати продукти

• Autel MaxiCharger Single: до V1.03.51

Вид слабост

• CWE-1191 On-Chip Debug and Test Interface With Improper Access Control
• CWE-1244 Internal Asset Exposed to Unsafe Debug Access Level or State

История

Други уязвимости в Autel MaxiCharger Single

• 8.6CVE-2026-8988
• 9.4CVE-2026-8987
• 9.5CVE-2026-8986
• 10.0CVE-2026-8985
• 10.0CVE-2026-8984

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-8989
• https://nvd.nist.gov/vuln/detail/CVE-2026-8989
• https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/