Vulnerability · Published May 28, 2026 · Assigned by icscert

CVE-2026-9037Download of code without integrity check in XCharge C6

Critical 9.3

In plain English

A critical-severity security flaw in C6 from XCharge. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.2%top 84.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. Because cryptographic signatures are not verified, an attacker with the ability to interfere with or impersonate the management channel could cause the device to install an unauthorized firmware package. This condition could allow execution of unauthorized code with high privileges on the device.

Affected products (as reported)

Vendor	Product	Versions
XCharge	C6	0 – before May_22_2026

Weakness: CWE-494 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-08 government-resource