This vulnerability arises from an insecure default configuration in the XCharge C6 device's remote management service. The service is exposed via the charging connector interface, which is normally used for vehicle-charger communication. Because it accepts a default administrative credential, an attacker with physical access to the charging port can authenticate and gain full administrative control over the device. This is classified under CWE-1188, indicating initialization of a resource with an insecure default. The CVSS 4.0 base score is 8.6, reflecting high severity with attack vector being physical and low attack complexity.

An attacker with physical access to the charging interface can exploit this vulnerability to gain full administrative privileges on the XCharge C6 device. This could allow unauthorized control over the device's remote management functions, potentially leading to disruption or manipulation of charging operations. The vulnerability does not require user interaction and has a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict physical access to the charging interface to trusted personnel only and change default administrative credentials if possible. Monitor vendor communications for updates regarding patches or configuration changes to mitigate this vulnerability.