XCharge C6 chargers vulnerable to firmware tampering, code execution
XCharge C6 electric vehicle chargers contain three critical vulnerabilities enabling firmware tampering, code execution via buffer overflow, and administrative access via default credentials.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has disclosed three vulnerabilities in XCharge C6 electric vehicle charging controllers deployed worldwide in the transportation sector. CVE-2026-9037 involves a firmware update mechanism that fails to validate cryptographic signatures, allowing attackers who can intercept or impersonate the management channel to install malicious firmware. CVE-2026-9038 is a stack-based buffer overflow in signal-processing logic that permits physical attackers at the charging interface to trigger memory corruption and execute unauthorized code with elevated privileges. CVE-2026-9039 exposes a remote management service on the charging connector interface that accepts default administrative credentials, enabling physical attackers to gain full administrative control.
All three vulnerabilities affect XCharge C6 devices with firmware versions prior to May 22, 2026. XCharge has confirmed that remediation updates have been deployed to all affected chargers. The vendor recommends users contact XCharge Support if they have questions about the remediation status of their devices. No known public exploitation targeting these vulnerabilities has been reported to CISA at this time.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-08
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs