This vulnerability involves a stack-based buffer overflow (CWE-121) in the signal-processing logic of the XCharge C6 charging controller. Specifically, the device does not properly validate the length of message fields received through its charging interface, allowing an attacker with physical access to supply oversized input. This can cause memory corruption, potentially enabling execution of arbitrary code with elevated privileges. The CVSS 4.0 vector indicates the attack requires physical access but has low attack complexity and no user interaction, with high impact on confidentiality, integrity, availability, and security requirements. No patch or vendor remediation level has been disclosed.

Successful exploitation could allow an attacker with physical access to the charging interface to execute unauthorized code with elevated privileges on the XCharge C6 device. This could compromise the device’s operation and security, potentially affecting the charging process and related systems. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict physical access to the charging interface to trusted personnel only to mitigate risk.