CVE-2026-9039
High
Description
A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default administrative credential. A malicious device physically connected to the charging interface could leverage this misconfiguration to obtain full administrative access.
SeverityHigh
CVSS8.6
Exploit probability—
ProductC6
PublishedMay 28, 2026
First seenMay 28, 2026
Weakness typeCWE-1188CWE-1188
How to fix
Update
- XCharge C6May_22_2026 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| XCharge C6 | v < May_22_2026 | May_22_2026 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.