CVE-2026-8989: Autel Maxi Charger Single RCE Vulnerability

CVE-2026-8989 Overview

CVE-2026-8989 affects the Autel Maxi Charger Single electric vehicle charging station firmware through version V1.03.51. The device exposes hardware recovery pins on the NXP i.MX6 system-on-chip without physical or logical protection. An attacker with physical access can enter the serial download recovery mode and boot attacker-controlled code directly into memory. This access enables firmware extraction, modification, and disclosure of sensitive data stored on the device. The weakness is categorized as [CWE-1191] (On-Chip Debug and Test Interface With Improper Access Control).

Critical Impact
Physical access to the charger permits full firmware compromise, extraction of embedded secrets, and persistent malicious code implantation on the NXP i.MX6 platform.

Affected Products

Autel Maxi Charger Single firmware versions up to and including V1.03.51
NXP i.MX6 application processor recovery interface as integrated in the charger
Deployments relying on the affected firmware for EV charging operations

Discovery Timeline

2026-07-21 - CVE-2026-8989 published to the National Vulnerability Database
2026-07-22 - Entry last modified in NVD
Vulnerability research published by CyberDanube Security Research

Technical Details for CVE-2026-8989

Vulnerability Analysis

The Autel Maxi Charger Single is built around the NXP i.MX6 application processor. NXP i.MX series SoCs include a serial download recovery mode, commonly reached by asserting specific BOOT_MODE pins during power-on reset. This mode is intended for factory provisioning and field recovery. It allows a host to upload an unsigned bootstream over USB or UART directly into on-chip RAM.

In the affected charger, the recovery-mode pins are physically accessible on the printed circuit board and are not gated by fuses, tamper detection, or High Assurance Boot (HAB) enforcement. An attacker who opens the enclosure can toggle these pins, force the SoC into serial download mode, and stream arbitrary code into the processor. Because the boot ROM executes the attacker-supplied image, all subsequent security controls implemented in firmware are bypassed.

Root Cause

The root cause is improper access control on a debug and test interface, tracked as [CWE-1191]. The vendor did not blow the SoC security fuses to enforce authenticated boot, and did not physically protect the recovery-mode strapping pins. Recovery mode therefore remains available to anyone with physical access to the mainboard.

Attack Vector

Exploitation requires physical access to the charger interior. The attacker opens the enclosure, connects to the exposed pins, and reboots the device into NXP serial download mode. Tools such as imx_usb_loader or sb_loader can then upload a custom image. From that foothold, the attacker can read raw flash contents, extract cryptographic keys and Wi-Fi credentials, patch the firmware image, and re-flash the device with a persistent backdoor. The exploitation mechanism is documented in the CyberDanube advisory; no remote or network-adjacent attack path is required.

Detection Methods for CVE-2026-8989

Indicators of Compromise

Physical evidence of enclosure tampering, including broken tamper seals, tool marks, or replaced fasteners on the charger housing.
Unexpected firmware version strings, boot banners, or configuration values that do not match the vendor-signed release manifest.
Charger behavior anomalies such as unauthorized outbound network connections, new listening services, or altered charging session logs.

Detection Strategies

Compute cryptographic hashes of extracted firmware images during maintenance windows and compare against the vendor-published baseline for version V1.03.51 or later.
Monitor management-plane telemetry from the charger fleet for deviations in reported firmware version, MAC address, or backend registration identifiers.
Deploy tamper-evident seals and periodically inspect charger enclosures deployed in publicly accessible locations.

Monitoring Recommendations

Centralize charger authentication and session logs in a SIEM and alert on unexpected reboots, factory-reset events, or repeated connectivity loss that could indicate hands-on tampering.
Correlate physical site access records with charger reboot events to identify suspicious maintenance windows.
Track certificate and key rotation status per device; a device whose credentials appear reused elsewhere may have been cloned via extracted firmware.

How to Mitigate CVE-2026-8989

Immediate Actions Required

Inventory all Autel Maxi Charger Single units running firmware V1.03.51 or earlier and prioritize those installed in publicly accessible or unattended locations.
Install physical tamper seals on charger enclosures and implement scheduled inspection procedures.
Restrict physical access to charger mainboards through secured cabinets, locked service panels, or surveillance coverage where feasible.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-8989. Because the weakness lies in hardware-level recovery pin exposure and unfused SoC security, a firmware update alone cannot fully remediate the issue. Operators should consult Autel directly for a hardware revision or field-service procedure that blows the NXP i.MX6 HAB fuses and physically covers the recovery pins. Monitor the CyberDanube research advisory for updates.

Workarounds

Rotate any credentials, API keys, or backend certificates that were provisioned to affected chargers, assuming they may be extractable.
Segment chargers on a dedicated VLAN with strict egress filtering so that a compromised unit cannot pivot into backend management systems.
Enable mutual TLS and per-device certificate binding on the charger-to-cloud channel to limit the value of any extracted device identity.

bash

# Example: restrict charger management VLAN egress on an upstream firewall
iptables -A FORWARD -i vlan-chargers -d 10.0.0.0/8 -j DROP
iptables -A FORWARD -i vlan-chargers -p tcp --dport 443 \
  -d backend.charging.example.com -j ACCEPT
iptables -A FORWARD -i vlan-chargers -j DROP