CVE-2026-36742 identifies an insecure permissions vulnerability in the Hiseeu C90 v5.7.15 device. Specifically, the UART bootloader interface is exposed when the device's battery is disconnected, enabling access to a hidden or debug mode. This condition could potentially be exploited to gain unauthorized control or manipulate the device at a low level. There is no information on affected versions beyond v5.7.15, no CVSS score, and no known exploits or patches at this time.

Unauthorized access to the UART bootloader could allow an attacker with physical access to the device to interact with the bootloader, potentially leading to device manipulation or compromise. However, exploitation requires physical interaction (battery disconnection), and no known exploits are reported. The lack of a patch or remediation guidance means the vulnerability remains unmitigated as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict physical access to the device to prevent exploitation via the UART bootloader. Monitor vendor communications for updates on patches or mitigations.