CVE-2026-8989 Open Recovery Mode

High 8.6 Published 21 Jul 2026 Updated 22 Jul 2026

Physical attackers can bypass security restrictions via exposed recovery pins to execute arbitrary code and extract sensitive data from Autel Maxi Charger devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-8989?

CVE-2026-8989 is a high-severity vulnerability in Autel MaxiCharger Single, published on 21 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data.

Weakness: CWE-1244, CWE-1191

Which versions are affected by CVE-2026-8989?

It affects 1 product.

Products include Autel Maxicharger Single Charger Firmware.

How do I fix CVE-2026-8989?

No fix has been published for CVE-2026-8989 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-8989 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8989 exists.

Sources

Also known as GHSA-wpf3-8j9v-2qg2.