This vulnerability (CVE-2026-9039) in the XCharge C6 product arises from CWE-1188, which is the initialization of a resource with an insecure default. Specifically, the device’s remote management service is exposed through the charging connector interface and accepts a default administrative credential. This misconfiguration permits an attacker with physical access to the charging interface to establish an authenticated session and obtain full administrative control over the device. The CVSS 4.0 base score is 8.6, indicating high severity, with attack vector being physical (AV:P), low attack complexity, and no privileges or user interaction required. The vulnerability impacts confidentiality, integrity, availability, and security requirements highly.

An attacker with physical access to the charging connector can leverage the default administrative credential to gain full administrative access to the XCharge C6 device. This could allow unauthorized control over the device’s remote management functions, potentially leading to disruption or manipulation of charging operations. The vulnerability affects multiple security properties including confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — no official fix or remediation guidance is currently available from the vendor. Organizations using XCharge C6 devices should monitor the vendor’s advisories for updates. Until a fix is released, restricting physical access to the charging connectors and changing default credentials if possible are recommended interim measures.