CVE-2026-8988 Access to Bootloader

High 8.6 Published 21 Jul 2026 Updated 22 Jul 2026

Physical attackers can interrupt the boot process via UART to access the bootloader and gain operating system control on Autel Maxi Charger Single devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-8988?

CVE-2026-8988 is a high-severity vulnerability in Autel MaxiCharger Single, published on 21 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An attacker with physical access can modify the boot configuration or file system to obtain operating system access.

Weakness: CWE-1191

Which versions are affected by CVE-2026-8988?

It affects 1 product.

Products include Autel Maxicharger Single Charger Firmware.

How do I fix CVE-2026-8988?

No fix has been published for CVE-2026-8988 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-8988 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8988 exists.

Sources

Also known as GHSA-qpg5-v459-hjvj.