The UART bootloader on Hiseeu C90 firmware v5.7.15 is exposed when the battery is disconnected, revealing a hidden or debug mode that grants direct firmware programming access. This vulnerability, reflecting insecure permissions (CWE‑276), enables an attacker to reflash or tamper with the device’s firmware, potentially leading to proprietary code execution or persistent compromise of device integrity. The impact is inferred from the fact that bootloader access allows upgraded firmware to be loaded without authentication, thereby compromising confidentiality, integrity, and availability of the device’s software stack.

All Hiseeu C90 units running firmware version 5.7.15 are affected. No other product versions or vendors were explicitly identified in the advisory. The lack of additional affected system information means that the scope of the vulnerability is limited to the mentioned firmware revision.

The exploitability requires the attacker to physically access the device and remove its power source, which is inferred from the description of battery disconnection enabling debug mode. The EPSS score is < 1% and the CVSS score is 6.8, and the vulnerability is not listed in CISA KEV. While physical access constraints reduce volume of potential attackers, the severity of the attack—granting root‑level firmware modification—remains high if such access is achieved.