CVE-2026-36742 identifies an insecure permissions vulnerability in the Hiseeu C90 v5.7.15 device. Specifically, the UART bootloader becomes accessible when the device's battery is disconnected, exposing a hidden or debug mode that should not be accessible under normal conditions. This vulnerability is classified under CWE-276 (Insecure Permissions) and has a CVSS v3.1 base score of 6.8, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no information about affected versions beyond v5.7.15, no vendor advisory or patch available, and no known exploits reported.

Successful exploitation could allow an attacker with physical access to the device to access the UART bootloader via the debug mode when the battery is disconnected. This could lead to full compromise of device confidentiality, integrity, and availability. However, exploitation requires physical access and battery disconnection, limiting remote attack feasibility. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict physical access to affected devices and avoid disconnecting the battery unnecessarily. Monitor vendor channels for updates regarding patches or mitigations.