CVE-2026-9039 — Initialization of a resource with an insecure default in XCharge C6

CVE-2026-9039

Initialization of a resource with an insecure default in XCharge C6 PUBLISHED

Description (CNA)

A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default administrative credential. A malicious device physically connected to the charging interface could leverage this misconfiguration to obtain full administrative access.

Affected (CNA)

Vendor / product	Versions
XCharge / C6	affected 0 before May_22_2026

CWE

CWE-1188

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-08

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.