CVE-2026-8989

MediumCVSS 6.8/10Last modified Oct 24, 2026

Description

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1191CWE-1244

Affected software

No affected versions have been published.

Timeline

Published
Jul 21, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-898907.8In the Linux kernel, the following vulnerability has been resolved: media: go7007: defer the ALSA v4l2 put until card release go7007_snd_iCVE-2026-89891In the Linux kernel, the following vulnerability has been resolved: media: em28xx: fix use-after-free of dev_next->devlist on disconnect WCVE-2026-89892In the Linux kernel, the following vulnerability has been resolved: media: em28xx: defer audio-only extension registration The audio-only CVE-2026-898937.8In the Linux kernel, the following vulnerability has been resolved: media: cx23885: cancel NetUP CI work before teardown netup_ci_exit() fCVE-2026-898947.8In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy viCVE-2026-89895In the Linux kernel, the following vulnerability has been resolved: media: cobalt: Avoid freeing ALSA private data twice snd_cobalt_card_cCVE-2026-89896In the Linux kernel, the following vulnerability has been resolved: media: cedrus: fix memory leak in cedrus_init_ctrls() In cedrus_init_cCVE-2026-898977.5In the Linux kernel, the following vulnerability has been resolved: media: cec: Serialize exclusive follower delivery cec_receive_notify()CVE-2026-898988.8In the Linux kernel, the following vulnerability has been resolved: media: cec: extron-da-hd-4k-plus: add sanity check Add check to prevenCVE-2026-898997.8In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmitCVE-2026-89905.3A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile application and grant himself full accessCVE-2026-89900In the Linux kernel, the following vulnerability has been resolved: media: cec: core: Fix kmemleak due to missed rc_free_device() call The
CVE-2026-8989: Medium severity, CVSS 6.8 | Vulnix