The XCharge C6 charging controller contains a vulnerability (CVE-2026-9037) classified as CWE-494, involving the download of code without integrity checks. Specifically, the device’s firmware update process fails to validate cryptographic signatures on firmware packages delivered via its management interface. This flaw enables attackers capable of interfering with or impersonating the management channel to install malicious firmware, resulting in unauthorized code execution with elevated privileges. The CVSS 4.0 score is 9.3 (critical), reflecting the vulnerability’s network attack vector, low complexity, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time, and the device is not a cloud service.

Successful exploitation allows an attacker to install unauthorized firmware on the XCharge C6 device, leading to execution of arbitrary code with high privileges. This compromises the device’s confidentiality, integrity, and availability, potentially allowing full control over the charging controller. The vulnerability is exploitable remotely over the network without authentication or user interaction, increasing its risk severity. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should restrict access to the device’s management interface to trusted networks and monitor for unauthorized firmware update attempts. Avoid exposing the management interface to untrusted networks to reduce the risk of interception or impersonation attacks.